Security

Built to be trusted

Security is part of the product, not a page in the documentation. This is what TaskNow does today.

Access

Five workspace roles
Admin, Manager, Member, Viewer and Guest. The rules are enforced by the API and the live socket layer, not only by the interface, so hiding a button is never the only thing in the way.
Invitation only
After the first Admin exists, every new account needs a valid invitation. Invitation links are single use and expire after seven days.
Sessions that end
A session expires after 12 hours, and a password reset signs out every other session on the account.

Hashed passwords
Passwords are hashed with bcrypt and must be at least 10 characters. TaskNow never stores or emails a password.
Hashed tokens
Invitation and reset tokens are stored only as SHA-256 hashes and expire automatically. A reset link works once, for 60 minutes.

Private file storage
Files are checked on the server, kept outside the database and opened only through short lived links that verify board access first.
Isolated by default
Runs on isolated infrastructure with encrypted connections. Your data is never shared with third parties.
No trackers
The site loads no advertising or analytics scripts and makes no requests to anyone else. The only cookies are the ones that keep you signed in.

Encrypted in transit
Every connection is HTTPS, and browsers are told to refuse anything else.
A strict content policy
Scripts run only from TaskNow itself, the site cannot be framed by another, and requests that change data are checked for where they came from.
Careful with the outside world
Webhook automations refuse private network addresses and never follow redirects, and public endpoints are rate limited.

If you have found a security problem in TaskNow, tell us before telling anyone else and we will work with you on it.

TaskNow is invitation only. Tell us about your team and an Admin will be in touch.