Security Policy

This Security Policy describes the real technical and organizational controls we use to protect TaskGlaze and the data it holds. We'd rather this page state exactly what we do than read impressively and be wrong — every control listed below reflects our actual, current implementation, not an aspirational target. We may update these controls over time; any update will not materially reduce the protections described here without notice.

TaskGlaze's application and database servers are hosted with a reputable infrastructure provider in the EU. Our network is configured on a default-deny basis: only the ports required to serve the Service over the web, and to allow secure administrative access, are reachable from the public internet at all — every internal service, including our database and cache layer, sits on a private, internal-only network and cannot be reached from the public internet under any circumstance. We intentionally don't publish our specific hosting provider, server locations, or network configuration in detail on this page, since doing so would mostly help an attacker, not a customer — our formal Subprocessor disclosure (required for GDPR-transparency purposes, not published as a hardening map) names our hosting provider and its country/region in the Privacy Policy's list of third-party providers, and in its section on international data transfers.

• All traffic to the Service is encrypted in transit via HTTPS/TLS, with HTTP Strict Transport Security (HSTS) enforced.
• Passwords are hashed with bcrypt — never stored or logged in plain text, and never reversible.
• Sensitive secrets at rest — two-factor authentication seeds and connected-mailbox (Outreach CRM) credentials — are encrypted using AES-256-GCM.
• Password-reset, email-verification, and similar sensitive links are signed/encrypted tokens, not guessable identifiers.

Administrative access to customer data is restricted to designated staff accounts, gated by an admin-only flag in our system plus mandatory two-factor authentication on that specific account — an admin account without 2FA enabled is denied access outright, not just warned. Every admin action against customer data is written to an internal audit log.

Account-level protections available to every TaskGlaze user: optional two-factor authentication (TOTP, free on every Plan), account lockout after repeated failed login attempts, and rate limiting on every authentication-related endpoint (login, password reset, verification) at both the per-account and per-IP level.

• A host-level firewall configured on a default-deny basis, with only the minimum necessary ports open to the public internet;
• Automated intrusion-detection tooling that monitors and blocks brute-force and other abusive access patterns against our infrastructure;
• Rate limiting at the web-server and application level, tuned per endpoint sensitivity (authentication endpoints are limited more tightly than general traffic);
• Bot and abuse protection on sign-up, login, and password-reset forms;
• Security response headers on every request (Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Strict-Transport-Security, Referrer-Policy, Permissions-Policy).

When TaskGlaze audits a website on your behalf — for a site you're auditing directly, or a competitor/prospect domain you're researching — our crawler identifies itself with a descriptive, non-disguised user agent rather than posing as a regular browser, and reads and honors that site's robots.txt file: a page disallowed for our crawler is never fetched, and where a site publishes a Crawl-delay directive, our crawler paces its requests accordingly. This is true regardless of whose account initiated the audit, and it applies to every crawl the Service performs, not just ones you run against your own domain.

The Outreach CRM's optional mailbox connection is treated as a particularly sensitive integration: credentials are encrypted at rest (AES-256-GCM), reply-checking always opens the mailbox in IMAP read-only (EXAMINE) mode so the mail server itself refuses any state change for the duration of the connection, and disconnecting a mailbox deletes the stored credential immediately rather than leaving it in a deactivated row. Full detail is in the Privacy Policy's "Connected email accounts" section.

We run automated weekly and monthly full-system backups (including the database), encrypted, with weekly backups retained on a rolling ~5-week window and monthly backups retained for 12 months. Backups are stored off-site (encrypted, not readable without our separately-held encryption key) for disaster-recovery purposes, and backup completion is monitored with automatic alerting on failure.

We only engage third-party providers (Subprocessors) necessary to operate specific features, and only with a written agreement in place covering confidentiality and data-protection obligations. Our current Subprocessors, and what each one can access, are listed in full in our Privacy Policy.

If we become aware of a security incident affecting personal data, we investigate, take reasonable steps to contain and remediate it, and notify affected users and any relevant authority as required by applicable law — see the Data Processing Agreement's "Personal Data Breaches" section for the specific notification commitment we make to business customers.

We do not currently run a paid bug bounty program. If you believe you've found a genuine security vulnerability in TaskGlaze, please report it to support@taskglaze.com with enough detail to reproduce it. We ask that you not access, modify, or exfiltrate data beyond what's strictly necessary to demonstrate the issue, and that you give us a reasonable opportunity to fix it before any public disclosure. We will acknowledge a good-faith report and keep you updated on remediation. With your permission, we credit people who report a confirmed issue this way in our Security Hall of Fame.

We don't pay for reports, but with your permission we credit people who report a confirmed, previously unknown issue this way in our Security Hall of Fame, which also lists what is and isn't eligible.

Security is shared: enable two-factor authentication on your Account, use a strong, unique password, use an app-specific password where your mailbox provider supports one instead of your primary account password when connecting a mailbox, and keep the device you access TaskGlaze from reasonably secure. See the Terms of Service's "Account registration & security" section for the full allocation of responsibility.

We may update this Security Policy as our infrastructure and practices evolve. Material changes will be reflected here with an updated "Last updated" date; we will not materially reduce the protections described here without prior notice on this page.

TASKGLAZE LTD (operating TaskGlaze) can be reached for any security question at support@taskglaze.com.