Where your data lives
- The application and its database are hosted inside the European Union (France), and that is where your data is stored.
- Traffic to kyrotask.com passes through Cloudflare’s network: your browser’s encrypted connection ends at the Cloudflare server nearest to you — which can be outside the EU — and travels on to our server in France encrypted again.
- PostgreSQL and Redis run on the same private network as the application; the database is not exposed to the public internet.
- File attachments are kept encrypted on the server’s own disk; backup copies are encrypted once more on the server and stored in Backblaze B2 (EU).
Encryption
Encrypted in transit
All traffic runs over HTTPS, and the server sends an HSTS header telling the browser never to reach this domain unencrypted again.
Secrets encrypted at rest
Two-factor seeds, recovery codes, calendar feed keys, webhook signing secrets and integration credentials are written to the database encrypted. The encryption key ring is itself protected by a separate certificate — a database dump alone cannot open those secrets.
Files encrypted at rest
Every file you upload — attachments, proof versions, portal intake submissions — is written to disk encrypted. Each file is sealed under its own key, and that key is protected by the same certificate the secrets use. A disk, a backup or a snapshot that leaks without the certificate does not make the files readable.
Security headers
Referrer-Policy, Permissions-Policy (camera, microphone and geolocation off), X-Content-Type-Options and a Content-Security-Policy are sent on every response.
Credentials
- Passwords are stored with ASP.NET Identity’s standard algorithm (PBKDF2-HMAC-SHA256) — no plaintext password exists anywhere.
- All seven link-borne credentials are stored as hashes only: session refresh token, portal refresh token, API key, calendar feed key, organization invite, portal invite and password-reset link. A leaked database yields no working link.
- Passwords must be at least 8 characters and contain an uppercase letter, a lowercase letter and a digit.
- Five consecutive failed sign-in attempts lock the account for 15 minutes.
Access control
Two-factor authentication
TOTP-based 2FA with recovery codes can be enabled on any account. An organization owner can require 2FA org-wide; while it is required, a member who has not set it up cannot complete sign-in.
Role hierarchy
Owner > Admin > Manager > Member. A Manager sees only the members and work in their own subtree, and every permission check runs through a single authorization service.
Project visibility
A project is either organization-wide or private. A private project is visible only to its owner, explicitly invited members and managers with access — and every surface asks the same rule, including search, dashboards and the activity feed.
The client wall
The client portal is a separate authentication scheme. Clients see only client-facing tasks in projects shared with them; internal comments, costs and time logs stay behind that wall.
The operator panel does not read your work
The panel that runs KyroTask administers accounts, organizations and subscriptions; it never reads task titles, descriptions, comments, files or time logs. That is a measurement, not a promise: every endpoint of the panel sits behind an automated test that checks it carries no work content. The operator accounts that reach it must carry a second factor: a session obtained with a password alone cannot open the panel.
Your data is yours
- You can export all of your data from account settings in one click — your profile, organization memberships and the tasks you are part of come down as a machine-readable file.
- When you request account deletion, your sessions are revoked immediately and an undo window opens; when it expires the account is permanently anonymized. Signing in with your password during that window cancels the request.
- If you own an organization shared with other people, you are asked to hand it over or delete it first — one person cannot take a whole team down with them.
- Dynamic QR scans never store the visitor’s IP address or raw browser identity; only a derived device type and, if configured, country and city are kept.
Product hardening
- Every address the server calls on your behalf (webhooks, QR destinations, Slack) is checked against the real IP resolved at connection time — private network addresses are refused and redirects are not followed.
- Sign-in, registration, 2FA, portal sign-in, API key usage and QR redirects each carry their own rate limits, and registration additionally has a per-IP daily ceiling.
- The registration form can be shielded by a bot challenge (Cloudflare Turnstile), and disposable email domains are refused.
- Production starts fail-closed: if any one of eight required settings is missing or unsafe, the application refuses to boot — a misconfigured server cannot quietly keep serving.
How long we keep it
| Data | How long it is kept |
|---|---|
| Tasks, comments, files, time logs | Until you delete them or close the organization |
| Deleted organization | 30-day quarantine — restorable during it, then permanently removed along with its records and files |
| Deleted account | 14-day undo window, then permanently anonymized |
| Session (refresh) records | Removed 30 days after being revoked or expiring — the same for staff and client-portal sessions |
| Closed client-portal account | 14 days after the client asks, their name, email address and phone number are removed; the comments they wrote stay, shown as a former client. Invoices already issued to them stay as issued, recipient's name and address included: an invoice is a record the agency is legally required to keep |
| Archived client | When an agency archives a client, portal access closes and the record stays whole, ready to be restored. After 365 days in the archive, the client's contact details (name, email address, phone, logo) are removed as they are for a closed portal account. The agency can also delete them permanently without waiting |
| Organization audit trail | 730 days — if your plan shows a shorter window, the screen says which window it is showing |
| Task activity trail | 730 days |
| In-app notifications | 180 days |
| QR scan statistics | 400 days — older scans leave the totals too; IP and raw browser identity are never stored |
| Payment provider webhook records | 90 days |
| Outbound webhook deliveries | 30 days (once they are finished) |
| Import reports | 90 days — the imported file itself is discarded as soon as the run ends; only the report is kept |
| Automation run log | 90 days — the record of which rule ran when. The rule itself, and its total run count, stay |
| Network trace of an abuse reporter | 30 days — the IP address is never stored; only a digest keyed with a server secret, which cannot be turned back into it and serves only to count how many different people reported the same code. The report itself stays as evidence |
| Outbound email | Email that was sent, and email that could not be delivered, is kept with its body and the links in it for 30 days, then deleted — sent email from when it was sent, undeliverable email from when it was written. Email still waiting to go stays until it goes. When an agency deletes a client permanently, the email that agency wrote to them is deleted without waiting; when an account is closed, so is the email already sent to its address |
The data processing addendum that puts our obligations as a processor in writing is at /dpa.
Sub-processors
Every third party that touches your data in order to run KyroTask. If the list changes, this page changes.
| Provider | Used for | Location |
|---|---|---|
| Contabo | Application, database and file hosting | France (EU) |
| Backblaze | Encrypted backup copies (encrypted on our server; the provider cannot read them) | EU |
| Brevo | Transactional email (invites, password resets, verification) | France (EU) |
| Paddle | Subscription payments — merchant of record | EU / UK |
| Cloudflare | DNS, CDN, reverse proxy (all traffic to the site), registration bot shield (Turnstile) and cookieless visit statistics (Web Analytics) | Global |
| Sign in with Google (only if you use it) | Global |
What we do not claim
- We hold no SOC 2, ISO 27001 or comparable certification. We have not been through an audit, and we do not say “compliant”.
- We make no contractual uptime (SLA) commitment. When the status page goes live, the real numbers will be visible there.
- We do not say “backed up daily” without having rehearsed a restore. An unrehearsed backup is a rumour.
- Encryption at rest does not stop someone who reaches the running server: the application has to be able to open your file in order to show it to you. What it protects is backups, snapshots and decommissioned disks.
- We do not run a bug bounty program — but we answer every vulnerability report we receive.
Report a vulnerability
If you have found a security issue, email [email protected]. We reply within one business day and ask that you hold the finding until a fix ships. We will not pursue legal action against researchers who report in good faith.