Security at Taskr
Controls that protect operational work and its supporting evidence.
Version 2026-08-18 · Last updated 18 August 2026Identity and access
Taskr uses verified email/password accounts, revocable host-only sessions, rate limits, optional TOTP multi-factor authentication and one-time recovery codes. Every product request re-checks organisation membership, role and location/team scope on the server.
Data protection
Operational records are isolated by organisation in D1. Evidence objects are protected in R2 and downloaded through authorised Taskr routes. Notification and webhook credentials are encrypted at rest and are never returned to the browser.
Resilience
Scheduled subsystems are isolated so one provider or storage failure does not stop later recovery jobs. Retention deletion requires a verified backup and respects legal hold. A production lifecycle canary checks account, task, evidence, approval, notification and export paths.
Responsible reporting
Use Taskr Support, choose “Security”, and include a clear impact summary and safe reproduction steps. Do not access another customer’s data, disrupt the service, use social engineering or include secrets in the report.