Snapshot 54857
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Skip to main content Last Updated: September 30, 2026 Security & Compliance Overview Our approach to security is straightforward: we protect your data with the same care and commitment we would use for our own. Taskade is operated by Taskcade Inc. and is architected with a defense-in-depth security model across multiple layers to ensure your information is safe, secure, and available when you need it. Every Taskade Genesis app, AI agent, and automation you build runs on this same foundation: you get the security posture of a serious platform without managing any of it yourself. This page describes how we protect data; what we collect and why is covered by our Privacy Policy, and the agreement that governs your use of Taskade is the Terms of Service. Security at a Glance Area How it's protected Data in transit TLS on every connection Data at rest AES-256 encryption for backups and stored credentials Workspace isolation Full segregation with role-based access control down to the query level Payments Processed by Stripe (PCI DSS Level 1), Apple, and Google; card details never touch Taskade servers AI processing Vetted providers under contracts that prohibit training on your content; which provider handles a request depends on the model you choose Vulnerability reports [email protected]; we fix what we confirm, and credit you by name on request. No paid bounty program This summary is for convenience only. The detail below is what applies. Defense in Depth Every request, whether from a browser, a published Taskade Genesis app, an AI agent, or the API, passes through the same layered controls: Request (app, agent, API, automation) | v EDGE WAF + DDoS protection, TLS termination | APPLICATION rate limiting, input validation, | query complexity analysis v AUTHORIZATION role-based access, workspace scoping, | permission-filtered queries v DATA row-level security, encrypted connections, parameterized queries, AES-256 backups Application layer Query complexity analysis guards against resource exhaustion attacks Rate limiting at user, IP, and API endpoint levels Input sanitization and validation on API and application entry points Permission-based data filtering at the database query level Data layer Row-level security (RLS) policies for fine-grained access control Encrypted connections with SSL/TLS certificate validation Parameterized queries preventing SQL injection Automated backup encryption with AES-256 Real-time collaboration WebSocket authentication with session validation Document synchronization over authenticated, TLS-encrypted connections Conflict resolution that preserves edit ordering and document integrity Presence tracking with privacy controls AI & Taskade Genesis Security Zero Training Policy: We contractually prohibit AI providers from using your data to train general AI models. While we implement technical and contractual controls, we cannot guarantee third-party compliance and disclaim liability for provider practices beyond our reasonable control. What your Taskade Genesis apps inherit Every app you build with Taskade Genesis is born secure, with no configuration required: Capability What it means for you Workspace-scoped permissions Apps automatically inherit the parent workspace's access rules Secure generation Code generation follows security-first templates with input validation Guarded automations Generated workflows include built-in rate limiting and error handling Encrypted agent conversations AI agent chats are encrypted and scoped to their workspace Automatic SSL Published apps and custom domains ship with SSL out of the box AI model and prompt safety AI requests are routed to vetted third-party model providers, each with its own security policies. Which provider handles a request depends on the model you choose and, on Auto, on your plan's default routing. Some providers operate outside the United States, including in China. The Privacy Policy explains this and how to get the current provider list User prompts are sanitized to mitigate prompt injection. No filter stops every attempt, so review AI outputs before you act on them System prompts are held server-side and are not returned to end users AI context is limited to your authorized workspace data only Content filtering screens for malicious code generation, and automated fallbacks engage if a provider experiences issues Automation security Integrations authenticate with OAuth 2.0 wherever the third-party service offers it; the rest use API keys or signed webhooks, whichever that service supports Automation credentials stored in an encrypted vault (AES-256) Workflow execution in sandboxed environments Failed authentication logging and alerting Enterprise Access Controls Complete data segregation between workspaces, hierarchical permission inheritance, and role-based access come standard on every plan. Advanced identity features by plan: Capability Availability Details Role-based access All plans Granular roles, Owner through Viewer Workspace isolation All plans Full segregation, parent-to-child permission inheritance SSO / SAML 2.0 Business and above Okta, Azure AD, Google Workspace, and other major identity providers; OIDC supported. Two-factor authentication is enforced by your identity provider Custom domains Business and above Branded authentication and app experience SCIM 2.0 provisioning Enterprise Automated user provisioning and deprovisioning, JIT provisioning Compliance and auditing SOC 2 Type II readiness (audit not yet complete) We are working toward SOC 2 Type II. Here is where that stands, stated plainly so you can rely on it: Security monitoring and internal reporting run today. An independent SOC 2 audit is part of the program and is not complete. We have no SOC 2 report to hand you yet, and we are not on a fixed external audit cadence. Incident response procedures are in place, and we notify affected customers as described below. We do not currently offer a signed Data Processing Agreement or Standard Contractual Clauses to customers. Audit trail: we log account and workspace activity, monitor security events, and can export workspace activity for you. We do not currently offer cryptographically immutable logs, tamper detection, or prebuilt compliance report formats. If an audit needs a specific export, ask us and we will tell you what we can produce. Data protection and its limits We do not scan for or automatically redact regulated data. Taskade does not detect or strip personal data, cardholder data (PCI), or health data (PHI) from what you send to AI features. Do not put data you are not permitted to send to a third-party AI provider into Taskade. Access is controlled by roles and workspace scoping rather than by data classification labels. Custom classification rules and approval workflows are not features we offer today. We design for least privilege and verify every request regardless of where it comes from, rather than trusting a network location. Security Operations & Incident Response Automated intrusion detection, analytics for unusual access patterns, geographic access monitoring, and automatic account lockdown for suspicious activity. Detection runs continuously and pages our team when something looks wrong; we do not staff a 24/7 security operations center. Incident response timeline These are the windows we aim for. They are targets, not contractual commitments. Window What happens 0-15 minutes Automated threat detection and initial containment 15-60 minutes Security team notification and assessment 1-4 hours Customer notification for confirmed incidents, where feasible 24-72 hours Detailed incident report and remediation plan Status updates are posted at status.taskade.com when feasible, with email notifications to affected users when appropriate and legally permissible. Post-incident analysis is conducted based on available resources, and transparency reports may be published periodically at our discretion. Business continuity High-availability architecture (targets, not contractual commitments; see the Terms of Service): Measure Target Deployment Single AWS region (US East) Replication Real-time across availability zones Recovery Time Objective (RTO) Under 4 hours Recovery Point Objective (RPO) Under 1 hour Disaster recovery testing Exercised internally as part of our program; not externally validated today Integrations & Vendor Security Our integrations use OAuth 2.0 with granular permission scopes wherever the third-party service offers it, and API keys or signed webhooks where it does not. Tokens refresh automatically, credentials are stored encrypted, and third-party data access is logged. We share only the data an integration needs, and we stop sending data and remove stored credentials when you disconnect it. We review vendors before we connect them and ask for a SOC 2 report or equivalent from the providers that matter most, with Data Processing Agreements in place where they process personal data. We are a startup: this review is a real process, but it is not a formal, calendar-driven vendor audit program yet. Development & API Security Security is built into how we ship: security training for our engineering team, static and dynamic application security testing (SAST/DAST) in the release pipeline, dependency scanning with automated vulnerability patching, and security-focused code review. The public API, the same one behind every Taskade Genesis app and AI agent, is protected end to end: Personal access tokens and OAuth 2.0 with configurable permission scopes Rate limiting per user, IP, and query complexity Query depth limiting and field-level permissions API request logging with usage monitoring and anomaly detection Building on the API? The full reference lives in the Developer Docs, including authentication and rate limits. Compliance & Certifications Standard Status PCI DSS Card payments processed by Stripe, a certified PCI DSS Level 1 provider; mobile purchases by Apple and Google. Full card details never touch Taskade servers Google CASA We complete Google's Cloud Application Security Assessment for the Google API scopes we use, on the cycle Google requires. It is a Google review of that integration, not a general security certification SOC 2 Type II In progress; current practices are designed to align with SOC 2 requirements but no audit report exists yet GDPR Practices designed to align with General Data Protection Regulation principles (full compliance in progress) CCPA Practices aligned with California Consumer Privacy Act requirements (compliance in progress) ISO 27001 Security management system aligned with international standards (certification in progress) What runs today: automated dependency and vulnerability scanning on every build, plus SAST/DAST in the release pipeline. Independent third-party audits and penetration testing are part of our compliance roadmap; we are not on a fixed audit or pen-test cadence yet, and we will not claim one until we are. Where a certification we hold has a renewal cycle, we keep it current. Report a Security Issue We are committed to working with the security community to keep Taskade secure for everyone. Channel Detail Contact [email protected], monitored by our support team and routed to engineering Response time We are a small team and do not guarantee a response time. Reports go to a monitored mailbox and are routed to engineering; complex reports can take longer to triage Disclosure 90-day coordinated disclosure when feasible, subject to investigation requirements Rewards We do not run a bug bounty program and do not pay for vulnerability reports, in cash, gift cards, subscription credit or any equivalent. This applies to every report, however severe. What we offer is that we read it, act on what is valid, and tell you what we decided Safe harbor If you act in good faith, stay within your own test account, and give us reasonable time to fix an issue, we will not pursue legal action against you for that research. We cannot waive claims belonging to our customers or other third parties Recognition: on request, we credit you by name in the disclosure thread once a fix ships. We do not maintain a public researcher listing or hall of fame. Processing times vary based on complexity and available resources. Enterprise documentation: our published security documents and control status live in our Trust Center. Anything not published there is available to enterprise customers under NDA. Our SOC 2 status is stated above. We will share penetration test summaries once we have them. Ask us at [email protected]. Accessibility: Taskade does not publish a VPAT or WCAG conformance statement. Request an accessibility questionnaire at [email protected]. Contact and Related Policies Taskade is operated by Taskcade Inc., San Francisco, California, United States. General, billing, and security questions: [email protected] Trust Center: trust.taskade.com System status: status.taskade.com See also our Privacy Policy, Terms of Service, and support documents. Security measures and policies are subject to change based on operational needs and regulatory requirements. Got a question? Our team reads every message and replies fast. Contact us[email protected] Loved by teams at...