How we look after your data.

What we do to keep your workspace safe, in plain terms — and what to ask us if you need more detail for a review.

In transit

Nothing travels in the clear.

Every request to TaskSync is served over HTTPS. Browsers are told to refuse an unencrypted connection for a year, including on subdomains, so a downgrade attack has nothing to downgrade to.

TLS on every connection
HSTS with a one-year max-age, subdomains included
Session cookies are HTTP-only and same-site
No mixed content: the site loads no assets over plain HTTP

Accounts

Passwords we cannot read.

Passwords are stored only as salted one-way hashes. Nobody at TaskSync can read yours, and a database copy would not reveal it. The strength rules are enforced on the server, not just in the browser.

Salted one-way hashing — plaintext is never stored
At least 12 characters, and not a commonly used password
Sign-in, sign-up and password-reset are all rate limited
Reset links are single-use and expire after 60 minutes
Email addresses are verified before an account is fully active

Two-step sign-in

A code from your phone, as well as your password.

Anyone can switch on two-step sign-in in Settings → Security: scan a QR code with an authenticator app, enter the 6-digit code, and keep the recovery codes somewhere safe. Owners and admins can require it for everyone in their company.

Works with any authenticator app (time-based codes)
10 single-use recovery codes if you lose your phone
A used code cannot be replayed; repeated wrong codes lock for 15 minutes
See your signed-in devices and sign out of the others
How to switch it on

Secrets, backups and logs

What we keep safe behind the scenes.

Keys and passwords that TaskSync holds for you — payment and mail settings, webhook secrets, connected-store credentials, two-step sign-in secrets — are encrypted in the database. The database is backed up every night, and a copy is kept off-site.

Stored secrets encrypted with the application key
API tokens and share links stored only as hashes
Nightly database backups, kept for 14 days, with an off-site copy
Sign-ins, failed sign-ins and password resets recorded in an audit log
Company settings changes listed in Settings history

Access

Separation between customers, and inside your team.

Every record belongs to exactly one workspace, and every query is scoped to the workspace of the person making it. Inside a workspace, what each member can see and do is governed by the role its administrators give them.

Each customer’s data is logically isolated from every other
Role-based permissions on every action, checked server-side
Owners and administrators control who joins and what they can reach
Administrative access to production is limited and logged

Payments

We never see your card.

Card details go straight to Stripe or Razorpay and never reach our servers. The only card information we hold is the brand and the last four digits, so you can tell which card is on file.

Card numbers, expiry dates and CVVs are never stored by us
Payments handled by Stripe and Razorpay, both PCI-DSS certified
We store only the card brand and last four digits

The browser

Hardened at the edge.

TaskSync sends a set of response headers on every page that limit what a compromised or malicious script could do, and a cookie banner means no analytics loads until you allow it.

Content-Security-Policy restricting where code may load from
X-Frame-Options — the app cannot be framed and clickjacked
X-Content-Type-Options and a strict Referrer-Policy
Permissions-Policy switching off device APIs we do not use
Analytics loads only after you consent

Hosting

Where your data is hosted.

Hosted on OVHcloud servers in Mumbai, India, with nightly encrypted backups kept off-site. Enterprise customers can ask for hosting that meets their country's requirements, confirmed in writing.

Your data

Yours to take, and to delete.

You can export your data at any time while the account is active. Closing an account starts a 90-day window in which it can still be restored, after which it is deleted. The full terms are in our Privacy Policy.

Export whenever you want, while the account is open
90 days to change your mind after closing, then deletion
Invoices retained for eight years, as Indian law requires
Full retention detail in the Privacy Policy

Doing a vendor review?

We answer security questionnaires and describe our incident-response process in writing on request, so you get current answers rather than a page that may have gone stale. Email support@arenasoftwares.com and we will come back within one business day.

Reporting a problem

Found something? Tell us.

If you believe you have found a vulnerability in TaskSync, email support@arenasoftwares.com with enough detail to reproduce it. We will acknowledge within one business day and keep you updated until it is resolved. Please give us a reasonable chance to fix an issue before disclosing it publicly, and do not access or modify data that is not yours while testing.