Security

TaskTraQ is a multi-tenant platform; security is part of the architecture, not a layer added later. The points below are not marketing promises — they describe the system as it runs today.

Workspace isolation

Every workspace’s data is kept separate, and every query is scoped server-side using the authenticated membership — never an identifier taken from the request. Customer organizations are isolated one level further: a portal user can only ever see their own organization’s records.

Authentication

Passwords are hashed with bcrypt. Sessions use a short-lived access token plus a single-use rotating refresh token; reusing a refresh token is detected and revokes the whole session family. New accounts cannot sign in before verifying their email address, and authentication endpoints are rate-limited.

API and webhooks

API keys are permission-scoped and stored only as hashes — the plaintext key never sits on the server. Webhook deliveries are HMAC-signed so the receiving system can verify the call genuinely came from TaskTraQ.

Files

Uploaded files are stored per workspace and served only through authenticated, membership-checked endpoints; no file is reachable at a public URL.

Transport security

All traffic is encrypted over HTTPS.

Found a vulnerability?

We welcome responsible reports: [email protected].