Your business data, isolated and accountable.
TasksPro is multi-tenant by design. Isolation, permissions and auditability are enforced in the database, not bolted on in the interface.
Controls
What protects your workspace
Row-level tenant isolation
Every record carries an organisation id and is protected by row-level security policies. Cross-tenant reads are impossible, not merely unlikely.
Layered roles
Platform admin, workspace owner, admin, manager and member — with guardrails preventing self-promotion or removing the last owner.
Per-module permissions
View and edit rights are granted per module per role, so finance data stays with finance and crews see only their jobs.
Audit history
Approvals, rejections, status changes and stock movements record who acted, when and with what note.
Encrypted in transit and at rest
TLS everywhere and encrypted managed Postgres storage with automated backups.
Least-privilege automation
Notification and digest jobs run through scoped, signed endpoints; internal helpers are not exposed to client roles.
Compliance
Compliance and data handling
The controls below are designed to help teams meet common governance and data-protection expectations. If you need a specific questionnaire or control mapping for your procurement process, contact our team.
Data residency and processing
TasksPro stores workspace data in managed Postgres databases. Backups and encryption are handled by the managed database provider. Contact us if you need details on current hosting regions for your workspace.
Access controls and accountability
Role-based access is enforced at the database level. Every state change that moves a record through a workflow records the actor, timestamp and reason, giving you an accountability trail for internal reviews.
Data retention and deletion
Workspace owners can request export or deletion of their organisation data. When an organisation is deleted, its records are removed in line with the provider's retention policies. We do not share tenant data with third parties for advertising.
Security testing and monitoring
We run automated dependency and database policy scans. Infrastructure is patched through the managed platform. Vulnerability reports are triaged within one business day.
Practices
Everyday practices
- Authentication with secure session handling and email verification
- Notifications filtered by module access before delivery
- Signed public endpoints for scheduled jobs
- Ownership transfer requires an explicit, audited action
- Regular automated security scanning of the database and dependencies
Reporting a vulnerability
If you believe you have found a security issue, email security@taskspro.ai with the details and reproduction steps. We acknowledge reports within one business day and will keep you updated until the issue is resolved.
Questions
Security FAQ
Common questions about how TasksPro protects workspace data.
How is my workspace data separated from other tenants?
Every table that holds workspace data includes an org_id column. Postgres row-level security policies enforce that queries only return rows where the user's membership matches that org_id. The policies cannot be bypassed from the application layer.
Who can change roles or remove members?
Workspace owners and admins can manage memberships. The platform prevents a user from changing their own role and prevents removing the last owner, so a workspace can never be left without an owner.
Can I restrict which modules a role can see?
Yes. Each module has view and edit permissions mapped to roles. A member without billing access, for example, will not see invoices, quotes or billing notifications.
What happens when a job, leave request or invoice changes status?
The transition is validated against a defined workflow. If the transition is allowed, the record is updated and an audit entry is created with the actor, previous status, new status and any note provided.
How do I report a security issue?
Email security@taskspro.ai with details and reproduction steps. We acknowledge reports within one business day and keep you updated until the issue is resolved.
Can I export or delete my organisation data?
Workspace owners can request a full export or deletion from the Settings page. We honour these requests within the timeframes set out in our Terms of Service and Privacy Policy.