Security

Security and privacy built into the foundations

How we keep each organization's work separate, controlled and recoverable.

Encryption

All traffic is HTTPS, with HTTP Strict Transport Security.
Passwords are stored only as salted PBKDF2 hashes; earlier passwords cannot be reused.
Authenticator secrets, webhook secrets, sign-on client secrets and similar are encrypted at rest with AES-256-GCM.
API keys, SCIM tokens and calendar addresses are stored as one-way hashes and shown only once.

Identity and sign-in

Single sign-on with OpenID Connect or SAML 2.0 (signed assertions only), on domains you prove you own.
Automatic provisioning and de-provisioning with SCIM 2.0.
Passkeys: sign in with a fingerprint, face or screen lock. They only work on this site, so a look-alike page gets nothing, and they count as two-step verification.
Two-step verification with authenticator apps and recovery codes, which an organization can require.
Sign in on a computer by approving on your phone: pick the matching number, so a prompt you did not expect is not approved by reflex.
Sign-in from Google, Microsoft, GitHub or Apple joins an account only through a verified e-mail address.
Sessions can be reviewed and revoked; organizations can restrict access to their own IP ranges.

Access control and isolation

Every record belongs to one workspace, and every request is checked against the caller’s current membership, role and access, not just their token.
Roles, per-module access levels, job-role profiles and team-only visibility decide who can see and change what.
Removing someone, or disabling their account, takes effect on their very next request.

Audit and monitoring

An audit log of sign-ins, permission, security and configuration changes.
Audit records can be streamed to your SIEM through a webhook.
Application tracing and metrics (OpenTelemetry) and health checks on every component.

Your data

Workspace owners can export everything as JSON files in one zip, at any time.
Retention you control: activity, notifications, chat and the audit log can be deleted after a period you choose.
Files are kept in object storage with checksums; deleted projects’ files are purged.

Building it safely

Rate limiting on every endpoint, with stricter limits on sign-in.
Writes can carry an idempotency key, so a retry from a weak mobile connection is answered again instead of done twice.
Webhooks are signed, and cannot point at private or internal networks.
Defences against cross-site request forgery and clickjacking, and strict security headers.
Continuous integration builds and tests every change and checks dependencies for known vulnerabilities.

Report a vulnerability

If you believe you have found a security problem, e-mail support@projecttracker.in with the steps to reproduce it. We reply within two working days, keep you informed while we fix it, and credit you if you wish. Please do not access other customers' data, degrade the service or run automated scans against it while investigating.

Report a problem

Machine-readable contact: /.well-known/security.txt