Snapshot 245458
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Skip to navigationSkip to main content Todoist Inc. security@doist.com Privacy PolicyOpens in new tab FAQ Company & Governance 1 to 10 of 19 results Compliance & Certifications Encryption and Data Security 1 to 10 of 11 results Application Security 1 to 10 of 23 results Incident Response & Business Continuity 1 to 10 of 13 results Sub-processors & Vendors Identity & Access Management 1 to 10 of 16 results Personnel & Device Security Network & Infrastructure Security Privacy & Data Rights 1 to 10 of 15 results Artificial Intelligence Top All FAQs Does Todoist maintain a formal information security program? Yes. We maintain a documented information security program with formal policies, defined roles, annual security awareness training, NIST- and ISO-based risk assessments and an Incident Response Plan. Every security policy is reviewed at least annually. https://trustcenter.todoist.net/faq?s=51pu819cojpwki8bmhafib Is there an assigned security owner or CISO equivalent? Our Chief Technology Officer (CTO) is the most senior person responsible for information security and the protection of information and information systems. https://trustcenter.todoist.net/faq?s=2t9aq5h15eh6m06yesd4b Are information security roles and responsibilities documented? Yes. Our Information Security Roles and Responsibilities policy defines the key positions, including executive leadership, engineering leadership, the CTO and the compliance manager. Responsibilities are communicated at hire and through documented policies and job descriptions. https://trustcenter.todoist.net/faq?s=4k7s13etmk6up531vkr71w Does senior management review security risks? Yes. Senior leadership receives regular risk reports, and we communicate risk assessment results to executive leadership with formal reporting at least annually. https://trustcenter.todoist.net/faq?s=93yhbgktl9n5a7tf7p461g Are security policies reviewed and updated annually? Yes. We review and update policies and procedures at least annually, including the linked procedures, standards and guidelines. https://trustcenter.todoist.net/faq?s=a8ave0v8feisarnrrcj5p Do employees acknowledge security policies? Yes. Everyone formally acknowledges their security responsibilities at hire, and we provision access only after the Information Security Policy has been acknowledged. https://trustcenter.todoist.net/faq?s=ebc3mx07v2qihhmgm0hgqr Where's Todoist incorporated and headquartered? Todoist Inc. is registered in the United States 251 Little Falls Drive, Wilmington, DE 19808. https://trustcenter.todoist.net/faq?s=8bh20vac0yfszdswf62izw How many employees does Todoist have? Todoist has approximately 100 employees. We operate as a fully remote company with no physical offices. https://trustcenter.todoist.net/faq?s=okid7vtd04r01gyjw8w51j How does Todoist assess security risks? We run a formal risk management process based on NIST 800-30 and ISO 27005 standards. We assess risk at least annually and whenever significant changes occur, and we document and report the results to executive leadership. We review capacity and resource monitoring in the same cycle. https://trustcenter.todoist.net/faq?s=gb1vasgf6gr7h4kl3n52j2 Does Todoist have data protection policies? Yes. We maintain documented policies covering access control, data management, cryptography, secure development, incident response and physical security, all formally approved and reviewed annually. https://trustcenter.todoist.net/faq?s=1iia1qvvdej25dhqzxxej9 Is Todoist's customer support outsourced? No. Support is provided entirely by our in-house Customer Experience team, working across time zones and in multiple languages. https://trustcenter.todoist.net/faq?s=y61ghutl9cxbfyv7ymtic Does Todoist have a code of conduct? Yes. Our Code of Conduct applies to all employees and contractors, sets out expected behavior, prohibits discrimination and harassment, and is acknowledged at hire. https://trustcenter.todoist.net/faq?s=9sfvkd1kxp77huu202u8bd Does Todoist have a whistleblower policy? Yes. Our Whistleblower Policy lets employees and others report concerns anonymously through an online form, year-round, and prohibits retaliation. https://trustcenter.todoist.net/faq?s=y6s8fr9qyef2yy8ww2ehm Does Todoist maintain an asset inventory? Yes. We identify, document and catalog all organizational and software assets in an inventory system, and update it to reflect acquisitions, disposals and modifications. https://trustcenter.todoist.net/faq?s=184m2qmd410o4ro0sk1z3v How is physical security handled with no offices? We have no offices. Our Physical Security Policy governs what remains: preventing unauthorized physical access to information and processing facilities, and requiring any third party that stores or processes confidential data to meet the same physical and environmental controls. https://trustcenter.todoist.net/faq?s=ny0h5tfqjrxxintm98zf4 Where are services performed from? We operate as a fully remote company. Personnel locations and any restrictions are documented, and the service is delivered from cloud infrastructure in the United States. https://trustcenter.todoist.net/faq?s=q30ipcdq5h2v6e3r1fe34k Is Todoist subject to regulatory oversight? Yes. We comply with GDPR and CCPA and maintain SOC 2 compliance. These requirements involve ongoing monitoring, reporting, and audits. https://trustcenter.todoist.net/faq?s=dstkgabx6g8ruy9lqttpi How does Todoist ensure financial sustainability? We've been in business since 2007, and executive leadership approves capital expenditure for the information security and privacy programs. https://trustcenter.todoist.net/faq?s=whq4fyj69hbazus523eney Are there controls against tax evasion facilitation? Yes. Compliance policies prohibit unauthorized or illegal activity, and a whistleblower policy encourages reporting. https://trustcenter.todoist.net/faq?s=itaqmy9mpkd97aewrm1hk0 Is Todoist SOC 2 Type II compliant, and how do I get the report? Yes, we maintain SOC 2 Type II compliance. You can find our full list of certifications in the [Overview tab](https://trustcenter.todoist.net/). Customers with a legitimate business need can download the full report after signing our NDA. https://trustcenter.todoist.net/faq?s=xn771ej3rr6e7vdjyivuz9 Are you ISO 27001 certified? We aren't currently ISO 27001 certified, but our security program aligns closely with the ISO 27001 framework. https://trustcenter.todoist.net/faq?s=mf4z7mny5taa9w37bj11 Does Todoist comply with GDPR? Yes. We maintain policies and procedures to ensure ongoing compliance, our incident response plan includes reporting breaches to regulators within 72 hours, we offer a pre-signed Data Processing Agreement, and all customer data is processed in the United States. https://trustcenter.todoist.net/faq?s=pyb7bkwomyesnkn0p7ppn Is Todoist HIPAA compliant? No. We aren't HIPAA compliant and don't sign Business Associate Agreements (BAAs), so Todoist shouldn't be used to store protected health information. If HIPAA support would affect your decision, [let us know](https://todoist.typeform.com/certifications). We track the certifications our customers need. https://trustcenter.todoist.net/faq?s=85s3c6wqwbtp5i2p5o1vao Which security frameworks does Todoist align with? We align our security program and risk management with ISO 27001, ISO 27005 and NIST 800-30/37, and we maintain SOC 2 Type II compliance. These frameworks guide policy development, risk assessments and the overall program. https://trustcenter.todoist.net/faq?s=2werdd2npe3hptyo5qgt7 Does Todoist carry cybersecurity insurance? No. We don't currently hold a cybersecurity insurance policy. We focus on proactive assurance through our SOC 2 Type II attestation, GDPR compliance and the security program documented in this Trust Center. https://trustcenter.todoist.net/faq?s=5q9ob9l5gv83fej5ny1zg3 Will Todoist sign my organization's NDA? No. We don't make exceptions to our [Terms of Service](https://doist.com/terms-of-service) and don't complete or sign vendor-requested NDA forms. Our SOC 2 report is shared under our own mutual NDA. https://trustcenter.todoist.net/faq?s=7cnhpq4nj5zot0qx96qw9 How is personal data encrypted? We encrypt stored data with AES-256 and data in transit with TLS 1.2 or above. Backups are encrypted with AES-256 and signed with RSA 2048. https://trustcenter.todoist.net/faq?s=e3n993u7i04p8v9wuh73s How is personal data protected? We use encryption to safeguard data. User content, such as tasks and comments, resides in our data stores, which get shielded from internet traffic, and have a strict access policy inside the company. Access to it is audited, requires multiple layers of authentication, and is only allowed for a valid business purpose. In other words, there's no way for any entitled internal employee to access it without others knowing. The need to access user content is rare. https://trustcenter.todoist.net/faq?s=i4e8kdwxg9rgasjnuublk2 Why does Todoist collect personal data? We collect personal data only where necessary to provide, maintain, secure and improve our products, for the purposes set out in our [Privacy Policy](https://doist.com/privacy). https://trustcenter.todoist.net/faq?s=pu9wezyf6s9mzm2y7nc2t Who owns my data in Todoist? When using Todoist in personal workspace, Doist is considered a Data Processor which means that we control how your user data is processed and are responsible for the data to be processed within GDPR. **Shared Projects in a Personal Workspace** When you share content with other Todoist users (including in shared projects within a personal workspace): - All collaborators own the data and content in the shared project. - If the original creator of the shared project deletes their account or leaves the project, ownership transfers to the remaining collaborators in the shared project. - This joint ownership doesn't impact the original creator's ownership of any copyrighted content they uploaded to the service. - By sharing your content, you grant each collaborator the right to access, use, reproduce, distribute, display, edit, perform, and otherwise interact with such content through our service. **Shared Projects in a Team Workspace** When you join and/or create shared projects in the Team workspace: - You agree to comply with the policies of the applicable organization and any agreement between you and that organization. - The organization is the owner of all user content in the respective workspace. - All user content in the organizational workspace may be shared with the organization and may be modified, deleted, or accessed by the organization. - The organization may terminate your access to the organizational workspace at any time, and you may not be able to access your content in that workspace. - By transferring any content to the organizational workspace, you grant the organization broad rights to your user content. https://trustcenter.todoist.net/faq?s=t8kvmd3vbfl4mwxg46163h Does Todoist encrypt data at rest? Yes. Todoist uses Amazon Web Services (AWS) servers to host all user data and makes extensive use of AWS's built-in firewalls to protect your data against unauthorized remote access. Projects, tasks, comments, account information, and payment information are all stored and encrypted at rest on AWS infrastructure. https://trustcenter.todoist.net/faq?s=r9laoarecji0m0f3mxbtr Does Todoist encrypt data in-transit? Yes. All user data, including project names, task names, comments, uploaded files, account details, and payment information, is sent using industry-standard traffic protection. We use TLS 1.2 or higher, with either 128-bit or 256-bit encryption depending on the browser. https://trustcenter.todoist.net/faq?s=wexhkk540ckkjkgmm3bhti Does Todoist keep my data separate from other customers' data? Todoist is a multi-tenant service: all customer data sits in the same storage platform, separated logically at the record level rather than in per-customer databases or hardware. Environments are segregated, access to production requires MFA and is reviewed quarterly, and data is encrypted at rest and in transit. We don't offer single-tenant hosting. https://trustcenter.todoist.net/faq?s=8xrohdtrltu7ddzfx92eu Are Todoist's encryption standards documented? Yes. Our Cryptography Policy lists approved algorithms, including AES-256, and requires strong cryptography with documented key management processes in accordance with industry standards such as NIST SP 800-57. https://trustcenter.todoist.net/faq?s=zh90x031admui1psmm1u6f Are backups encrypted? Yes. We encrypt backups with AES-256 under our Cryptography Policy. https://trustcenter.todoist.net/faq?s=j9dhh5su7cr3unptuq920 How are encryption keys managed in Todoist? We manage encryption keys under our Cryptography Policy, in line with NIST SP 800-57, with access to keys controlled by our Access Control Policy. Approved algorithms include AES-256 at rest, with strong ciphers enforced in transit. https://trustcenter.todoist.net/faq?s=61wmym0ghxumsqgv2bksqs Does Todoist classify data? Yes. A data classification policy ensures confidential data is properly secured and limited to authorized personnel. Records of processing activities and retention periods are documented, and compliance is verified through internal and external audits. https://trustcenter.todoist.net/faq?s=62e87kqhs2i78f7x0are9 Does Todoist back up my data? Yes. We back up in-scope systems daily, store backups separately from production data, and test restoration at least annually. https://trustcenter.todoist.net/faq?s=dam9vron7tfbn3tbabe8 Where do I report a security vulnerability? You can find all the details about Todoist's Bug Bounty Program here: [Todoist Bug Bounty Policy](https://www.todoist.com/bug-bounty) https://trustcenter.todoist.net/faq?s=rl51t5lo9m9frb16bk89iz Are production and non-production environments separated? Yes. We keep production, test, staging and development environments logically or physically segregated. https://trustcenter.todoist.net/faq?s=454el4dhvw97unilmjp9g How does Todoist manage changes to production systems? We document, review and approve all changes to systems, networks and processing facilities before deployment. The process covers planning, impact assessment, authorization, communication, testing and quality control. Changes run through our GitHub organization, with GitHub Actions used for continuous integration and deployment. https://trustcenter.todoist.net/faq?s=6zr98ghvs7g7du65ja9y Are changes tested before reaching production? Yes. We test and review changes in a controlled non-production environment before release, and we keep production and non-production environments segregated. https://trustcenter.todoist.net/faq?s=btwubawuqi56rrepxq50k3 Is live customer data used for testing? No. We prohibit the use of live customer data for testing. Test data confidentiality is maintained, and any restoration of personal data is logged. https://trustcenter.todoist.net/faq?s=52c0xve8dgzdpzwp9bmkiq What configuration management tooling is used? We manage infrastructure as code, using AWS CloudFormation and Terraform. https://trustcenter.todoist.net/faq?s=nh7myzcwblnn0zg16ffnr How often does Todoist scan for vulnerabilities? We scan public-facing production systems at least quarterly, run dependency scanning continuously in our CI/CD pipeline, and use runtime security tools for live vulnerability and threat detection. https://trustcenter.todoist.net/faq?s=2y2z1xi4u23vh1wfb9vp7y How quickly are vulnerabilities fixed in Todoist? We fix vulnerabilities on severity-based timelines: critical within 7 days, high within 30, medium within 60 and low within 90. The same timelines govern security patching of servers, workstations and company devices. https://trustcenter.todoist.net/faq?s=srhpk0pxcq4qgcc9ux5s Does Todoist perform static and dynamic application security testing? Yes. All application code undergoes static code analysis, including SAST, and is scanned for vulnerabilities before deployment. Security testing is performed at defined points during the development lifecycle. No code is deployed to production without successful test results and remediation of any issues found. https://trustcenter.todoist.net/faq?s=x6mu83j2tvfxivikcua2q Does Todoist scan third-party and open source dependencies? Yes. We perform software composition analysis as part of vulnerability management and our secure development lifecycle. GitHub Dependabot and Mend Renovate scan for vulnerable dependencies in the CI/CD pipeline. An inventory of software assets is maintained, and only approved software is deployed through formal change management. https://trustcenter.todoist.net/faq?s=xs8v9mdx8owbg596pcbba Is code peer reviewed before release? Yes. All code undergoes peer review, vulnerability scanning and security testing before deployment in Todoist. Applications follow secure coding guidelines and secure-by-design principles. https://trustcenter.todoist.net/faq?s=vga9gptd90xgkz468113 Is outsourced development supervised? Yes. Any outsourced development is supervised and must meet our standards and policies. https://trustcenter.todoist.net/faq?s=ie432qr5ti00vn842qsya Does Todoist have DDoS protection? Yes. Firewalls and DDoS protection are implemented for our cloud environments. Intrusion detection systems, file integrity monitoring, firewalls and network access control lists are used at the network perimeter and other critical points for traffic monitoring, attack detection and threat prevention. https://trustcenter.todoist.net/faq?s=3j0gk2llrlfli1hys6ro How is the production network protected? Firewalls and network access control lists manage network traffic to and from the production environment. Network rules are reviewed annually and changes require approval. Remote access is encrypted and restricted to approved devices. Network Address Translation is used to prevent internal IP disclosure. https://trustcenter.todoist.net/faq?s=hthksarezg77d8upfxt2 What cloud security tooling does Todoist use? We follow AWS best practices for the AWS resources we use. We also use AWS Security Hub and AWS GuardDuty to detect and respond to critical security issues at scale. https://trustcenter.todoist.net/faq?s=4y5qe4go6sakib93m21tek Is end-of-life software decommissioned? Yes. We maintain a list of the software in use and upgrade it as it approaches end of life or end of support. We own no hardware; the service runs on cloud infrastructure. https://trustcenter.todoist.net/faq?s=yfpmg3a2m96gj53fqvdgmg Does Todoist use anti-malware protection? Yes. Anti-malware protections are installed on all company-issued endpoints, except those running operating systems not typically prone to malware. These detect common malicious threats and can remove, block or quarantine them. Updates are automatic and incidents are reported through the security incident process. Threat detection and response software is also used for company email. https://trustcenter.todoist.net/faq?s=ch750f0rcn7v25r2374h How does Todoist secure company devices? Anti-malware protections are installed on all company-issued endpoints. Portable and removable media are encrypted. A clear screen and clear desk policy is enforced, requiring personnel to lock screens when not in use and to keep confidential materials secured. https://trustcenter.todoist.net/faq?s=csugwto294q4xmht8rfkj4 How do the mobile apps handle TLS and secret storage? The iOS and Android apps rely on the operating system's TLS implementation rather than configuring cipher suites themselves. On iOS, App Transport Security defaults apply. On Android, the app uses OkHttp's default TLS stack, backed by the Android platform's SSL implementation. API tokens are stored in app-private storage: the Keychain on iOS, and app-sandboxed private storage on Android. https://trustcenter.todoist.net/faq?s=q7lfs9xpb47lwi43lzr68u Can developers deploy their own changes to production? No. Developers are restricted from implementing or committing their own changes to production. All significant code changes require review and approval by authorized personnel before merging. Segregation of duties is enforced. https://trustcenter.todoist.net/faq?s=7kl29700wvoli4stmsir What has to be documented for a change? Significant changes must record purpose, specification, potential impact, dependencies and deployment plan. Changes require approval by authorized personnel and are logged. https://trustcenter.todoist.net/faq?s=d6nbhih9i1ygc00dhiacnd Does the development lifecycle cover decommissioning? Yes. Our software development lifecycle covers requirements, development, testing, deployment, maintenance and decommissioning. Significant code changes follow formal review. https://trustcenter.todoist.net/faq?s=5pvw125jblop3cg9geuhvl Does Todoist have an incident response plan? Yes. We maintain an approved, documented Incident Response Plan based on NIST guidance, covering preparation, identification, containment, recovery and reflection. https://trustcenter.todoist.net/faq?s=9vcnnnc2l39p1176f01lw Does Todoist run tabletop exercises to test its incident response plan? Yes. We run an annual tabletop exercise to validate our incident response capability. https://trustcenter.todoist.net/faq?s=ekbv4i4qagaadwqh4klsz Are incidents documented and reviewed? Yes. We document incidents throughout the response and hold a post-incident postmortem afterwards to review what happened, what we can learn and how to prevent recurrence. For severe issues we may publish a public postmortem. https://trustcenter.todoist.net/faq?s=30v61pvks20tftpsxtjk4 Does Todoist notify customers of security incidents? Yes. Under our Incident Response Plan, we publish an initial alert on our [status page](https://status.todoist.net/) and in the [Known issues](https://www.todoist.com/help/todoist/troubleshooting/known-issues) help article, typically within about 3 hours of an incident beginning. Where personal data is involved, we notify supervisory authorities within 72 hours, in line with GDPR. https://trustcenter.todoist.net/faq?s=x0mf57e08ljws47j2eruqj Do you maintain a business continuity plan? A documented Business Continuity and Disaster Recovery Plan is maintained and is reviewed and tested annually. https://trustcenter.todoist.net/faq?s=sva6rvapz2qt54y2n7a9ky Where can I find information about Todoist uptime and downtimes? We recommend checking out our [Status Page](https://status.todoist.net/). Here, you can subscribe for updates, check uptime information, stay informed about any outages, and view historical data. https://trustcenter.todoist.net/faq?s=edgxh4ydfpzmxs4o3eocec Has Todoist had security incidents? Yes. We've had incidents, all resolved, and we publish incident history on our [status page](https://status.todoist.net/). https://trustcenter.todoist.net/faq?s=gm7p6nhykq64c55mkel8sw Have there been material security incidents in the past year? No. No assets or resources were compromised in the past year. https://trustcenter.todoist.net/faq?s=7wqofridkrdv1amx111v3 What are Todoist's recovery objectives? We don't currently have defined recovery time or recovery point objectives. Live availability data for Todoist is available on our [status](https://status.todoist.net/) page. https://trustcenter.todoist.net/faq?s=xj5t78ot7lqdiqp20lk3ek Does Todoist maintain a separate disaster recovery site? No. We don't maintain a separate disaster recovery site. All systems are vendor-hosted, and continuity relies on the availability commitments of cloud providers including AWS and Google. Backups are stored in the same region as production. https://trustcenter.todoist.net/faq?s=9bo28ntch4653ky1ov8ut What are the backup and failover procedures? Backups run daily on all in-scope systems including customer data, are encrypted, and are stored separately from production data. A Business Continuity and Disaster Recovery Plan covers all critical systems, and disaster recovery including backup restoration is tested annually. https://trustcenter.todoist.net/faq?s=xg2bkpf0gfg71fi3mk04 How are customers told about degraded performance? Real-time and near real-time updates are provided through our status page, Help Center banners and official channels, covering degraded performance, availability and ongoing incidents. https://trustcenter.todoist.net/faq?s=dfbq30a72csrkutb89mh5 Are breach notification obligations contractual? Yes. Contractual agreements state information security responsibilities including breach notification. The Incident Response Plan requires notification to clients and supervisory authorities within 72 hours for personal data breaches. https://trustcenter.todoist.net/faq?s=sh9vdxwy9btbmd1osvs6wh Does Todoist use third-party services to process customer data? Yes. Todoist uses GDPR-compliant providers such as AWS, Stripe and Google Workspace, with safeguards in place for data sent to and received from each. Every provider that handles customer data is listed on the [sub-processors page](https://trustcenter.todoist.net/subprocessors), and each is risk-assessed before engagement and reviewed annually. https://trustcenter.todoist.net/faq?s=86csw64lu8v3kwygh6y55 Does Todoist use subcontractors? Yes. Some components of service delivery are subcontracted, including cloud hosting with AWS, penetration testing and system development. All third parties and contractors are subject to security, confidentiality and compliance requirements. https://trustcenter.todoist.net/faq?s=swjslk575tzolsxnrtt3p Are supplier choices influenced by sustainability? Yes. We consider sustainability performance when selecting suppliers, including environmental, social and governance criteria, protection of customer data, and adherence to physical and environmental security controls. https://trustcenter.todoist.net/faq?s=a4xipetoorpyek9gf33tcw Are contracts in place before data is shared with a third party? Yes. Written contracts and agreements are executed with third parties before confidential or personal data is shared or transmitted, covering legal and information security requirements. https://trustcenter.todoist.net/faq?s=55xssni6fs45o0lyepl0s Does Todoist enforce least privilege access? Yes. Todoist grants access to all systems and data on a least-privilege basis, so each person receives only the access their role requires. Access rights are reviewed quarterly and whenever a job role changes, and these reviews cover user, administrator, and service accounts. https://trustcenter.todoist.net/faq?s=gd8latodtfyf0f85kkvqj2 Does Todoist use separate accounts for privileged administrative tasks? Yes. Administrators keep separate accounts for administrative and non-administrative tasks, and privileged identities are never used for general activities such as browsing or email. https://trustcenter.todoist.net/faq?s=rt5lfflwdn7uqksbv9ggbz How does Todoist manage passwords? We require staff passwords of at least 14 characters, including an uppercase letter and a number where feasible. Special characters aren't required. Passwords are managed through a mandatory password manager with strong cryptography for storage and transmission, and accounts lock after failed sign-in attempts. https://trustcenter.todoist.net/faq?s=916ic9s2rme2g5vxz87b7l Does Todoist support SSO or SAML? No. We don't currently support SSO or SAML on any plan or tier. https://trustcenter.todoist.net/faq?s=c9254p5duky8xy5y3w72x Does Todoist support SCIM provisioning? No. We don't currently support SCIM provisioning on any plan or tier. https://trustcenter.todoist.net/faq?s=7w0uoygfjjd587b1fb4u Does Todoist provide audit logs to customers? Partially. Todoist offers Reporting (formerly the "Activity log") to admins in Business/Teams workspaces. It's a content activity log that records task and comment actions across the workspace, attributed to individual users. Todoist doesn't currently provide a dedicated security access/admin audit log (sign-in events, permission changes, admin configuration changes) exposed to customers or via API. https://trustcenter.todoist.net/faq?s=bff7j0e7cklxts0wu2u0k8 Does Todoist log security or administrative events for customers? No, not in a customer-facing way. Reporting doesn't capture sign-ins, failed logins, session events, role or permission changes, security configuration changes (SSO/SAML, SCIM provisioning, 2FA enforcement, password policy) or billing and workspace setting changes. We log and monitor these internally, but they aren't surfaced to customers today. https://trustcenter.todoist.net/faq?s=34v2otkt2yakhjwpcltjcg Does Todoist require MFA for its own administrators? Yes. Multi-factor authentication is required for all privileged and administrative access to production infrastructure. https://trustcenter.todoist.net/faq?s=d02prnexjytakl2r6j4qj Does Todoist support two-factor authentication (2FA), and can workspace admins enforce it? Yes, Todoist supports 2FA, but workspace admins can't currently require it for members on any plan. Each person can turn on 2FA with an authenticator app in their own account settings and should save their recovery codes when they set it up. https://trustcenter.todoist.net/faq?s=8ej2n57x77v5umpsa0s4s How often does Todoist review access? We review access at least quarterly to ensure it remains appropriately restricted. Access is role-based with least privilege enforced, and multi-factor authentication is required for production and privileged access. https://trustcenter.todoist.net/faq?s=10jmuqvsn5rxzy4vewz4z3 What happens to access when an employee leaves? Access is promptly disabled or removed upon termination or when no longer needed, with a maximum period of 72 business hours. Onboarding provisioning is initiated by HR through the issue tracking system and granted based on role. https://trustcenter.todoist.net/faq?s=o48vifb2kamb1ap43leqn Does Todoist enforce separation of duties? Yes. Conflicting responsibilities are segregated so no single individual can access, modify or use assets without authorization or detection. The initiation of an event is separated from its authorization, and the risk of collusion is considered when assigning access levels. https://trustcenter.todoist.net/faq?s=w2z8dhvzm5kzm5sqna5lo6 How is remote access secured? Remote access requires VPN with multi-factor authentication, and VPN keys use AES-256 encryption. We restrict remote access to approved devices and prohibit unauthorized remote access tools. Home networks must be securely configured, and we verify compliance through monitoring and audits. https://trustcenter.todoist.net/faq?s=sl0rfofh39j17rhbqo1uo Does Todoist allow personal devices (BYOD)? Yes, with conditions. Personal devices may access company resources only where they comply with our Mobile Device Policy, which requires password or biometric protection and device encryption. https://trustcenter.todoist.net/faq?s=ebtzanvbnlzjfupcm2bre Is suspicious authentication behavior monitored? Yes. Privileged logins and activities are logged and monitored, logs are reviewed regularly, alerts are configured for suspicious conditions, and unauthorized access attempts are investigated. https://trustcenter.todoist.net/faq?s=yjg7fzoqe95cwhnemzhad How are identities verified before access is granted? Only authorized administrators create accounts, after a documented request and approval from data owners or management. Identity is verified, and background checks including ID verification are conducted for employment. https://trustcenter.todoist.net/faq?s=px43m6d6kteubx3nhqiup Do Todoist employees receive security training? Yes. Everyone completes security awareness training at hire and annually after that, and we monitor completion. Developers also complete annual secure development training focused on threats such as the OWASP Top 10, and follow secure coding guidelines throughout the software development lifecycle. https://trustcenter.todoist.net/faq?s=y8jmfdp7rk1eji3hoo0d25 Is security training conducted at onboarding? Security awareness training is completed at the time of hire, with annual refreshers. https://trustcenter.todoist.net/faq?s=cp8xbsb5yrgkxgwyqfcxc Does Todoist run background checks on employees? Yes. We carry out background verification checks in accordance with applicable law, including criminal history checks unless prohibited by local statute. https://trustcenter.todoist.net/faq?s=ndw4w4nyprq5b5xiqhkad Can Todoist employees use removable media? Yes, with restrictions. We prohibit storing confidential data on removable media such as USB drives and CD/DVDs; any use for confidential or restricted data requires documented management approval. https://trustcenter.todoist.net/faq?s=fk3vw14mk1elu931ip9uca How is IT equipment disposed of? We securely wipe or physically destroy devices and media that have stored confidential or restricted data, including hard drives and mobile devices, using approved methods. We also securely dispose of confidential hardcopy, and obtain certificates of destruction where a third-party e-waste service is used. https://trustcenter.todoist.net/faq?s=dsb01al87ncm0ra8sqmer9 Is a clear screen and clear desk policy enforced? Yes. Personnel mustn't leave confidential materials unsecured and must lock screens when not in use. Remote work protocols require adherence to the same standards. https://trustcenter.todoist.net/faq?s=sygop8o1gmkqgc5oz5sbky Do Todoist employees have local administrator access to their devices? Yes. Employees have administrative access on their workstations. We rely on keeping software up to date and on monitoring the applications in use across the organization. https://trustcenter.todoist.net/faq?s=2hqo1ismt8ojuvqen013y Are session and screen lock timeouts enforced? Yes. Company devices lock the screen after 5 minutes of inactivity, enforced by policy, and remote access sessions time out after at most 2 hours. https://trustcenter.todoist.net/faq?s=fnesuue8wt65qmpxo6qw How are employee laptops configured and patched? End-user devices must comply with our policies, including changing vendor default passwords, removing unnecessary default accounts, and applying security patches within the same SLAs as servers. Devices must be locked when unattended. https://trustcenter.todoist.net/faq?s=ek4imwtcuiqd3vhdgawov Does Todoist have a network security policy? Yes. We publish and communicate a Network Security Policy and technical security standards, formally approved and reviewed annually. Network access is restricted and protected by firewalls and network access control lists. https://trustcenter.todoist.net/faq?s=4n6bksdau8zf3upse5x3c7 Are unnecessary services and ports disabled? Yes. We enable only the services, protocols and daemons a system needs, and disable unnecessary functionality including scripts, drivers, features, subsystems and file systems. https://trustcenter.todoist.net/faq?s=otgem1iqm2egfm7ixhvopj Are system clocks synchronized? Yes. Clocks on all relevant information processing systems are synchronized to network time servers using reputable time sources. https://trustcenter.todoist.net/faq?s=w34btw3cg6b1oa64tgx4x Is a managed detection and response (MDR) service used? No. There's no dedicated MDR solution. Network logs and service activity are monitored to alert on threats on our infrastructure. https://trustcenter.todoist.net/faq?s=ch7m74ovt12xqbdmbjwd59 Is a network topology diagram maintained? Yes. An up-to-date topology drawing of our networks is maintained, with strict control over firewall and access control rules. https://trustcenter.todoist.net/faq?s=whqr6ydvqvuvf3py7u4jgm Are servers hardened to a standard baseline? Yes. Standardized provisioning and hardening practices are applied to all servers and operating systems, including changing vendor default passwords, removing unnecessary accounts, enabling only necessary services and applying security patches. https://trustcenter.todoist.net/faq?s=hyq0580qixgblnhy3codww What email security controls are in place? Threat detection and response software is used for company email, anti-malware protections are in place, and email in transit is encrypted using strong cryptographic protocols. There's no dedicated email data loss prevention tool. https://trustcenter.todoist.net/faq?s=3buq94hzkotle2q4rnmaae Is the production network segmented? Yes. Virtual private clouds and subnets provide isolation and segmentation. Firewalls, DDoS protection, network access controls and annual security assessments are in place, with network rules reviewed annually. AWS Security Hub and GuardDuty are used for threat detection and response. https://trustcenter.todoist.net/faq?s=2rt8xfo4v08f77chcp6wik Are guest wireless networks separated from production? Yes. Guest wireless networks are segmented from corporate and production networks using network isolation, VLANs and firewalls, with strict traffic control. https://trustcenter.todoist.net/faq?s=5o4yn9iaoi8yfpnbiuq305 How are network devices patched? We rely on AWS as our cloud provider, which includes network management. Security patches for network infrastructure are applied by AWS under our agreement with them. https://trustcenter.todoist.net/faq?s=z17a6nzszwzukq7x6urld Where does Todoist store customer data? All customer data is stored and processed in Amazon Web Services (AWS) data centers in the US East region (us-east-1), Northern Virginia. We collect as little data as possible, and all data is encrypted using AES-256 encryption. We don't store customer data in the EU or EEA and don't currently offer regional data residency. AI features are processed through AWS Bedrock and Google Vertex AI in the United States. Our staff work remotely worldwide under access controls, but customer data itself stays in the United States. https://trustcenter.todoist.net/faq?s=b8dik0ksp0pjbeuwtg6f4 What cookies does Todoist use? We use cookies to collect information about your browsing activities and to distinguish you from other Todoist users. This aids your experience when using our app as well as allows us to improve its functionality. We use the following cookies: * **Strictly necessary** cookies: required to perform your login functionality, user authentication, and security; * **Functional** cookies: used to recognize you when you return to our website and personalize our content for you, greet you by name, and remember your preference; * **Analytical and advertising** cookies: used to help us understand how users engage with our product. We use a handful of third-party cookies: Google Analytics (analyzing website traffic and user behavior), Datadog (monitoring web performance and user experience), Stripe (handling payments and pricing/upgrade page), Zendesk (loading images and providing support or Help Center), YouTube (displaying videos on Help Center pages), Cloudinary (loading and optimizing images). https://trustcenter.todoist.net/faq?s=ogql8bk366pa0c57cl736d How do I access and export my data? You can export projects as CSV, download daily backups (Pro and Business), or use the API for your current data. You can find our API for Todoist [here](https://developer.todoist.com/api/v1/). Self-service export doesn't include archived projects, deleted items, Reporting history, payment information or integration settings. For a complete copy of your personal data, [get in touch](https://www.todoist.com/contact). https://trustcenter.todoist.net/faq?s=hp6js6oerkwck45x2yuum4 Are deleted tasks removed from Todoist's servers? Yes, on a deferred schedule. When you delete something, it's first soft-deleted: it's marked as deleted and disappears from your apps right away. After 365 days, it's hard-deleted, meaning permanently removed from our servers. The delay supports multi-device sync, because the deletion marker tells each of your devices that the item was deleted, so it doesn't come back. Your data is also stored in database backups. We keep them only for business continuity, in case we ever face major data loss, a long period of data unavailability, or data corruption. To date, we've never needed to use them. All data, including backups, is encrypted at rest. Backups can't be used to access an individual user's data. They can only be restored as a whole into a live database, where our regular data access controls apply. This means we can't retrieve an individual account's data from backups on request. Backups are automatically deleted after no more than 90 days. https://trustcenter.todoist.net/faq?s=eli7ktnchk67gxtju2gt4x Does Todoist retain personal data after an account is deleted? When you [delete your account](https://www.todoist.com/help/articles/delete-your-todoist-account-luq3xH), you lose access to it straight away, and we remove identifying details like your email address. Your deleted data is permanently purged from our databases within one year, and encrypted database backups are kept for up to 90 days. We can't restore a deleted account or provide data from our backups on request. https://trustcenter.todoist.net/faq?s=du766ysr7pnsjh9unsr5nj What personal data does Todoist collect? When registering for Todoist, you voluntarily give us information such as your name and email address. You can access and update this information at any time in your personal Account Settings. In addition, when you use our services, you give us consent to use the following data: * Email * IP address * Device ID * Name and surname (optional, not processed) * Job (optional, not processed) * Phone number (optional, not processed) * VAT ID (optional) * Invoice address (for Pro and Business accounts) For full details, see our [Privacy Policy](https://doist.com/privacy#1-information-we-collect). https://trustcenter.todoist.net/faq?s=xate6q38e07s6whceo0qz Does Todoist sell my data? No. We never sell data. https://trustcenter.todoist.net/faq?s=ige23u4noxn8jnndi6c2zx Does Todoist offer a Data Processing Agreement (DPA)? Yes, we offer a DPA that's pre-signed on behalf of Todoist. It can be completed by filling out your details and signing it [here](https://powerforms.docusign.net/e9184e9b-eb12-49df-8e64-2c2a5b682f5c?accountId=ce87fd9f-513c-4fbe-a90a-37d2b14c55d9&env=na2). We don't sign custom DPAs. https://trustcenter.todoist.net/faq?s=7hmzfy0ncgx3s58ga11fzs How long does Todoist retain data? We document retention periods in a Data Retention Matrix and review them annually. Deleted customer data is purged within one year, and database backups are kept for up to 90 days. Security event data is kept for 365 days, logs for 2 years, and customer support tickets for up to 25 months. Feedback and interviews may be kept for up to 5 years. We delete or de-identify personally identifiable information once it no longer has a business use. https://trustcenter.todoist.net/faq?s=cxskxx8tyypsxvt5yua9d How long are support conversations kept? We keep customer support tickets for up to 25 months after creation. Support conversations are encrypted in transit and at rest, with access restricted under our data classification policy. https://trustcenter.todoist.net/faq?s=3bmhdi8k2bqln16uyktv9y How long are security logs retained? We keep security event and system logs for 365 days, and service logs, including those in Datadog, for up to 2 years. We review logs regularly, with alerts configured for significant threats. https://trustcenter.todoist.net/faq?s=qbkd64uxn2ztw6o56zq0bv How is data securely disposed of? Data is securely deleted or archived when no longer needed. Disposal follows documented secure procedures, and media storing confidential data is erased or destroyed using approved methods. https://trustcenter.todoist.net/faq?s=l88qqzmwtwah7lgc73dt7s What happens to our data when we stop using Todoist? Cancelling a Pro or Business subscription doesn't delete your data. Your Pro account, or your Business workspace, moves to the Beginner plan at the end of the billing period. Your projects stay available, though some may become view-only until you upgrade again. When you delete your account or workspace, its data is no longer accessible straight away and is permanently purged from our databases within one year. Encrypted database backups are kept for up to 90 days. We keep data only as long as necessary for business, regulatory or contractual requirements. https://trustcenter.todoist.net/faq?s=f4sdrjoy7595ubfefuuc5 Does Todoist practice data minimization? Yes. Personal information is collected, used and retained only where there's a legitimate business purpose, limited to what's necessary, and securely deleted or de-identified when no longer needed. https://trustcenter.todoist.net/faq?s=1163sebhp4bof19z3ko2mv Can individuals withdraw consent? Yes. Individuals can ask us to delete their personal information following a verified request. Consent can't be withdrawn for data we're legally required to retain. https://trustcenter.todoist.net/faq?s=ewnbfg2j9e1bbcup6a96mu Which AI services does Todoist use? Todoist uses generative AI models including Claude, Nova, and Gemini, accessed through AWS Bedrock and Google Vertex AI within infrastructure Todoist controls. Customer data stays within this environment and isn't used to train these models, and the AI providers are contractually committed to that. Per-provider retention periods and links to each provider's privacy documentation are listed on the [Subprocessors](https://trustcenter.todoist.net/subprocessors) tab. https://trustcenter.todoist.net/faq?s=pgs0w509kxilgp8h4g7bo How long do AI providers retain data? Retention differs by provider and is listed against each AI subprocessor on the [Subprocessors](https://trustcenter.todoist.net/subprocessors) tab. For example, Amazon Bedrock doesn't store data. https://trustcenter.todoist.net/faq?s=f0dxh138dxxfona5iw8wz Is customer data used to train AI models? No. Customer data isn't used to train any AI models. The providers we use have committed that data processed through their services won't be used to train their models. https://trustcenter.todoist.net/faq?s=j1cuj1zx4wka80p9r05w2k Does Todoist conduct AI- or LLM-specific penetration testing? No. Penetration testing is conducted annually and covers network and application security assessments. It doesn't currently include AI or large language model-specific testing. https://trustcenter.todoist.net/faq?s=pqvmuumm00x4xsuv3g8iw Which specific AI models does Todoist use? We use Claude Haiku and Claude Sonnet, Nova Lite and Nova Pro, and Gemini Flash Lite, Gemini Flash and Gemini Pro. These run in the United States region. https://trustcenter.todoist.net/faq?s=sjoe22b42dnnz16ygnz6xm Does Todoist store data processed by AI features? No, with one exception. We don't store customer data generated or processed by AI features; the exception is Ramble sessions, which are retained for up to 24 hours. Per-provider retention is listed on the [Subprocessors](https://trustcenter.todoist.net/subprocessors) tab. https://trustcenter.todoist.net/faq?s=4rsxd5k4qzf3lkkcfz564 What controls apply when PII is processed by external AI vendors? We apply third-party risk assessments, written agreements specifying security requirements, monitoring and auditing of third-party services, and technical controls including logging, alerting and incident response. Data masking, encryption and access restrictions also apply. https://trustcenter.todoist.net/faq?s=mb0ikawmpyjmkuohxupnyc How does Todoist govern AI risk and fairness? We assess AI-related risks for likelihood and impact within our risk management framework, and we govern AI-generated insights under the same data management, privacy and security policies, with data classified by legal requirement, sensitivity and business criticality. https://trustcenter.todoist.net/faq?s=q5bf2e2q8bjb9wfeb6sr