How Taskly protects your data
Taskly isolates every workspace at the database level using PostgreSQL row-level security, stores your data in a managed database in the European Union, encrypts it in transit and at rest, and never sends your teammates’ email addresses to the AI model. Otto, the AI assistant, proposes changes as a diff you approve; it cannot create or edit anything on its own. Taskly holds no formal certification yet, and this page says so plainly rather than implying otherwise.
Security at a glance
The table below is the short version of Taskly’s security posture, including the parts Taskly does not have. Each row is expanded in its own section further down the page.
| Area | How Taskly handles it |
|---|---|
| Workspace isolation | Enforced inside PostgreSQL with row-level security, not in the interface |
| Database location | Managed PostgreSQL in the EU (AWS eu-central-1, Frankfurt) |
| Data in transit | HTTPS/TLS on every request |
| Data at rest | Encrypted by the database and hosting providers, backups included |
| Passwords | Hashed (bcrypt) by the authentication provider. Taskly never sees a raw password |
| Sign-in | Google OAuth, or email and password with a confirmation step |
| Teammate emails and the AI | Never sent to the model. Otto sees display names or stable pseudonyms |
| AI actions | Proposed as a before and after diff, applied only when you approve |
| Abuse protection | Turnstile bot checks on auth forms, rate limits and a daily AI spend cap |
| Account deletion | Self-serve in Settings, cascading across your records |
| Formal certification | None yet. No SOC 2, no ISO 27001, and no claim to either |
Workspace isolation: enforced by the database
Every team using Taskly works inside its own workspace, and every record is tagged to a workspace. Taskly enforces that boundary in PostgreSQL itself, using row-level security, rather than relying on the application to remember to filter. This is the difference between a rule the interface applies and a rule the database applies, and it is the single most important control on this page.
“When row security is enabled on a table, all normal access to the table for selecting rows or modifying rows must be allowed by a row security policy. If no policy exists for the table, a default-deny policy is used, meaning that no rows are visible or can be modified.”
In plain terms: the database refuses by default and only returns what a policy explicitly permits. A query issued on your behalf can only ever return rows from workspaces you belong to, so one customer’s data is not reachable by another. A bug in Taskly’s front end cannot widen that boundary, because the check does not live in the front end.
Where your Taskly data is stored
Taskly’s database is managed PostgreSQL, run by Supabase on AWS eu-central-1, which is the Frankfurt region in Germany. Your workspace data lives in the European Union. The application that serves ottotaskly.com and app.ottotaskly.com is hosted on Vercel and delivered from its global network, so requests may be routed through infrastructure close to you, but the durable copy of your tasks, projects, comments and workspace records sits in the EU database.
Encryption in transit and at rest
- In transit: Taskly serves all traffic over HTTPS/TLS. Data moving between your browser, the app and the database is encrypted on the wire.
- At rest: the Taskly database and its backups are encrypted at rest by the infrastructure providers that run them.
Authentication and sign-in
Taskly supports two ways in, and treats credentials the same way in both:
- Sign in with Google (OAuth) or with email and password.
- Passwords are hashed with bcrypt by the authentication provider. Taskly never stores them in plain text and never sees your raw password.
- New email accounts require email confirmation before they get access, which verifies the address belongs to you.
- Sessions use secure, httpOnly cookies, so session tokens are not readable by page scripts.
Roles and access control
Within a Taskly workspace, members hold a role: Admin or Member. Sensitive actions, meaning managing the workspace, its projects and its members, are restricted to admins, and that restriction is applied both in the app and in the database policies underneath it. As with isolation, the interface is the convenience layer and the database is the enforcement layer.
Bot protection, rate limits and spend caps
Taskly protects the endpoints that cost money or leak signal when abused. The sign-up, sign-in and password-reset forms run a Cloudflare Turnstile check, which keeps automated account creation and credential stuffing off the auth routes. Rate limits sit in front of the AI endpoints, the authentication forms and the feedback endpoint, so a single account cannot flood them. A daily token cap bounds total AI spend, which means a runaway loop or an abusive account degrades into a refusal rather than an open-ended bill.
What Otto is and is not sent
Otto runs server-side, only ever operates inside a workspace after verifying your membership of it, and proposes changes as a reviewable diff that you approve before anything is created or edited. To understand a request, Taskly sends the relevant text to its AI provider, OpenRouter, and gets back a structured result. The table below is exactly what does and does not cross that line.
| Data | Sent to the AI model? | Detail |
|---|---|---|
| Your message to Otto | Yes | It is the request Otto is answering |
| Task titles, status, priority, due date | Yes, a capped sample | Scoped to the workspace you are working in |
| Project names | Yes | So Otto can file a task under a project that already exists |
| Teammate display names | Yes | A name only. A member with no name becomes a stable pseudonym such as “Member 1a2b” |
| Teammate email addresses | No | Emails never leave the application |
| Your password | No | Taskly does not hold it in plain text either |
| Anything from other workspaces | No | Row-level security stops the query returning it in the first place |
Otto also carries built-in safety guardrails and refuses harmful or off-topic requests, and it cannot act outside your workspace or beyond the limits Taskly enforces server-side, such as capped batch sizes on bulk changes. The reasoning behind the approve-first design is set out in AI that asks first.
Subprocessors
Taskly relies on a small set of providers to run the product. Each one is listed below with what it does and what data it touches, so you can assess the chain rather than take the word “reputable” on trust.
| Provider | What it does for Taskly | What it touches |
|---|---|---|
| Supabase | Managed PostgreSQL database, authentication, realtime | Your workspace data at rest, in the EU (AWS eu-central-1) |
| Vercel | Application hosting and delivery | Requests in transit |
| OpenRouter | Routes Otto’s requests to an AI model | Your message, a task sample, project names, pseudonymised member labels |
| Optional OAuth sign-in | Your Google account identity, only if you choose that sign-in | |
| Resend | Transactional email (invitations, notifications) | Recipient addresses and message contents, when enabled |
Backups and availability
Taskly’s managed database provider performs automated backups, and those backups are encrypted at rest alongside the live database. Availability guarantees and point-in-time recovery windows scale with the hosting plan Taskly is on, and will improve as the product grows. Taskly does not currently publish an uptime SLA, and this page will say so until it does.
Your data and your rights
Your workspace data belongs to you. You can edit or delete tasks at any time, and Taskly has self-serve account deletion in Settings that permanently removes your account and cascades to your profile, memberships, comments, notifications and AI usage records. Workspaces you own are transferred to another member first, or deleted outright if you were the only person in them. To request a copy of your data, email security@ottotaskly.com. The Privacy Policy covers the rest.
Responsible disclosure
If you believe you have found a security vulnerability in Taskly, email security@ottotaskly.com with the details and steps to reproduce it. Taskly does not run a paid bug bounty, but responsible disclosure is genuinely welcome and reports are worked through and answered.
What Taskly does not have yet
Taskly is an early-stage product moving fast, and stating the gaps is part of being trustworthy about the rest. Taskly does not hold SOC 2 Type II or ISO 27001 certification, does not publish an uptime SLA, and does not yet offer SAML single sign-on, SCIM provisioning or customer-managed encryption keys. If your procurement process requires any of those today, Taskly is not the right fit yet, and we would rather tell you now than at the end of a security questionnaire.
What Taskly does have are sound fundamentals: database-enforced isolation, an EU-hosted database, encrypted transport, modern authentication, bot protection and rate limits on the endpoints that matter, and an AI layer that always acts with your consent.
Frequently asked questions
Is Taskly secure?+
Where is my Taskly data stored?+
Can the AI see my teammates’ email addresses?+
What data does Taskly send to the AI model?+
Can Otto change my tasks without my permission?+
Can another Taskly customer see my workspace data?+
Can I delete my Taskly account and all my data?+
Does Taskly have SOC 2 or ISO 27001 certification?+
Last reviewed: 27 August 2026 · Questions? security@ottotaskly.com