Last updated: July 6, 2026
This page is maintained by KaiTask to answer common security questions. It describes controls that are currently enabled in production. It is not an independent certification.
All traffic is served over HTTPS with TLS 1.2 or newer. Data at rest is encrypted using AES-256 by our hosting provider. Secrets and API keys are stored in a managed secrets store, never in source control.
Row-level security policies are enforced at the database layer on every public table. Users only see the organizations, projects, tasks and messages they are a member of. Application code uses the caller's session for reads; admin roles are checked via a security-definer function.
Email/password with hashed credentials, and optional Google Single Sign-On. Sessions are stored client-side as short-lived JWTs with rotating refresh tokens.
Structured request logs, edge-function logs and database health metrics are retained for 90 days. On a suspected incident we follow an internal runbook and notify affected Customers under GDPR Art. 33 (within 72 hours).
Automated encrypted backups, retained up to 35 days. Point-in-time recovery is available for the primary database.
KaiTask secures the platform. Customers are responsible for choosing strong passwords, keeping their devices secure, and controlling who they invite into their organization.
If you believe you have found a security vulnerability, email security@kaitask.app. Please do not test against production accounts other than your own, and give us reasonable time to fix issues before disclosure. We recognise contributions publicly on request.