encrypted at rest
Task descriptions, notes and subtask titles are encrypted under a per-group key. Even at the database layer, your sensitive content is not sitting in plain text.
// security
privacy-first, not as an afterthought
Encryption at rest, a managers-only vault, two-factor and step-up auth — built in, on every tier, never an upsell.
a managers-only vault
Keep credentials and secrets in a vault that only managers can reveal — auto-relocking after a couple of minutes, and never sent anywhere it does not need to go.
two-factor & step-up auth
TOTP two-factor on your account, plus step-up re-authentication that guards the few actions that really matter — revealing the vault, deleting data, inviting admins.
your data is yours
Export everything, any time, in open formats. No lock-in, no hostage data. Built in on every tier — never an upsell.
// principles
how we think about it
privacy built in, security opt-in
Privacy is the default; the heavier security controls are there the moment you want them — IP allowlists, trusted devices, re-auth windows.
off by default
Extensions and integrations stay inert until you switch them on. Nothing phones home that you did not enable.
least exposure
The vault is never transmitted to AI or third parties. Encrypted fields are decrypted only when, and where, they must be.