Last Updated: August 11, 2026

Security & Compliance

Overview

Our approach to security is straightforward: we protect your data with the same care and commitment we would use for our own.

Taskade is operated by Taskcade Inc. and is architected with a defense-in-depth security model across multiple layers to ensure your information is safe, secure, and available when you need it. Every Taskade Genesis app, AI agent, and automation you build runs on this same foundation: you get the security posture of a serious platform without managing any of it yourself.

This page describes how we protect data; what we collect and why is covered by our Privacy Policy, and the agreement that governs your use of Taskade is the Terms of Service.

Security at a Glance

Area	How it's protected
Data in transit	TLS on every connection
Data at rest	AES-256 encryption for backups and stored credentials
Workspace isolation	Full segregation with role-based access control down to the query level
Payments	Processed by Stripe (PCI DSS Level 1), Apple, and Google; card details never touch Taskade servers
AI processing	Vetted providers under contracts that prohibit training on your content; which provider handles a request depends on the model you choose
Vulnerability reports	[email protected]; private bug bounty, verified reports recognized

This summary is for convenience only. The detail below is what applies.

Defense in Depth

Every request, whether from a browser, a published Taskade Genesis app, an AI agent, or the API, passes through the same layered controls:

Request (app, agent, API, automation)
    |
    v
EDGE           WAF + DDoS protection, TLS termination
    |
APPLICATION    rate limiting, input validation,
    |          query complexity analysis
    v
AUTHORIZATION  role-based access, workspace scoping,
    |          permission-filtered queries
    v
DATA           row-level security, encrypted connections,
               parameterized queries, AES-256 backups

Application layer

Query complexity analysis guards against resource exhaustion attacks
Rate limiting at user, IP, and API endpoint levels
Input sanitization and validation on API and application entry points
Permission-based data filtering at the database query level

Data layer

Row-level security (RLS) policies for fine-grained access control
Encrypted connections with SSL/TLS certificate validation
Parameterized queries preventing SQL injection
Automated backup encryption with AES-256

Real-time collaboration

WebSocket authentication with session validation
Document synchronization over authenticated, TLS-encrypted connections
Conflict resolution that preserves edit ordering and document integrity
Presence tracking with privacy controls

AI & Taskade Genesis Security

Zero Training Policy: We contractually prohibit AI providers from using your data to train general AI models. While we implement technical and contractual controls, we cannot guarantee third-party compliance and disclaim liability for provider practices beyond our reasonable control.

What your Taskade Genesis apps inherit

Every app you build with Taskade Genesis is born secure, with no configuration required:

Capability	What it means for you
Workspace-scoped permissions	Apps automatically inherit the parent workspace's access rules
Secure generation	Code generation follows security-first templates with input validation
Guarded automations	Generated workflows include built-in rate limiting and error handling
Encrypted agent conversations	AI agent chats are encrypted and scoped to their workspace
Automatic SSL	Published apps and custom domains ship with SSL out of the box

AI model and prompt safety

AI requests are routed to vetted third-party model providers, each with its own security policies. Which provider handles a request depends on the model you choose and, on Auto, on your plan's default routing. Some providers operate outside the United States, including in China. The Privacy Policy explains this and how to get the current provider list
User prompts are sanitized to mitigate prompt injection. No filter stops every attempt, so review AI outputs before you act on them
System prompts are held server-side and are not returned to end users
AI context is limited to your authorized workspace data only
Content filtering screens for malicious code generation, and automated fallbacks engage if a provider experiences issues

Automation security

Integrations authenticate with OAuth 2.0 wherever the third-party service offers it; the rest use API keys or signed webhooks, whichever that service supports
Automation credentials stored in an encrypted vault (AES-256)
Workflow execution in sandboxed environments
Failed authentication logging and alerting

Enterprise Access Controls

Complete data segregation between workspaces, hierarchical permission inheritance, and role-based access come standard on every plan. Advanced identity features by plan:

Capability	Availability	Details
Role-based access	All plans	7 permission levels, Owner through Viewer
Workspace isolation	All plans	Full segregation, parent-to-child permission inheritance
SSO / SAML 2.0	Business and above	Okta, Azure AD, Google Workspace, and other major identity providers; OIDC supported. MFA enforcement flows through your identity provider
Custom domains	Business and above	Branded authentication and app experience
SCIM 2.0 provisioning	Enterprise	Automated user provisioning and deprovisioning, JIT provisioning

Compliance and auditing

SOC 2 Type II readiness (audit not yet complete)

We are working toward SOC 2 Type II. Here is where that stands, stated plainly so you can rely on it:

Security monitoring and internal reporting run today.
An independent SOC 2 audit is part of the program and is not complete. We have no SOC 2 report to hand you yet, and we are not on a fixed external audit cadence.
Incident response procedures are in place, and we notify affected customers as described below.
Data Processing Agreements are available on request.

Audit trail: we log account and workspace activity, monitor security events, and can export workspace activity for you. We do not currently offer cryptographically immutable logs, tamper detection, or prebuilt compliance report formats. If an audit needs a specific export, ask us and we will tell you what we can produce.

Data protection and its limits

We do not scan for or automatically redact regulated data. Taskade does not detect or strip personal data, cardholder data (PCI), or health data (PHI) from what you send to AI features. Do not put data you are not permitted to send to a third-party AI provider into Taskade.
Access is controlled by roles and workspace scoping rather than by data classification labels. Custom classification rules and approval workflows are not features we offer today.
We design for least privilege and verify every request regardless of where it comes from, rather than trusting a network location.

Security Operations & Incident Response

Automated intrusion detection, analytics for unusual access patterns, geographic access monitoring, and automatic account lockdown for suspicious activity. Detection runs continuously and pages our team when something looks wrong; we do not staff a 24/7 security operations center.

Incident response timeline

These are the windows we aim for. They are targets, not contractual commitments.

Window	What happens
0-15 minutes	Automated threat detection and initial containment
15-60 minutes	Security team notification and assessment
1-4 hours	Customer notification for confirmed incidents, where feasible
24-72 hours	Detailed incident report and remediation plan

Status updates are posted at status.taskade.com when feasible, with email notifications to affected users when appropriate and legally permissible. Post-incident analysis is conducted based on available resources, and transparency reports may be published periodically at our discretion.

Business continuity

High-availability architecture (targets, not contractual commitments; see the Terms of Service):

Measure	Target
Deployment	Multi-region with automatic failover
Replication	Real-time across availability zones
Recovery Time Objective (RTO)	Under 4 hours
Recovery Point Objective (RPO)	Under 1 hour
Disaster recovery testing	Exercised internally as part of our program; not externally validated today

Integrations & Vendor Security

Our integrations use OAuth 2.0 with granular permission scopes wherever the third-party service offers it, and API keys or signed webhooks where it does not. Tokens refresh automatically, credentials are stored encrypted, and third-party data access is logged. We share only the data an integration needs, and we stop sending data and remove stored credentials when you disconnect it.

We review vendors before we connect them and ask for a SOC 2 report or equivalent from the providers that matter most, with Data Processing Agreements in place where they process personal data. We are a startup: this review is a real process, but it is not a formal, calendar-driven vendor audit program yet.

Development & API Security

Security is built into how we ship: security training for our engineering team, static and dynamic application security testing (SAST/DAST) in the release pipeline, dependency scanning with automated vulnerability patching, and security-focused code review.

The public API, the same one behind every Taskade Genesis app and AI agent, is protected end to end:

Personal access tokens and OAuth 2.0 with configurable permission scopes
Rate limiting per user, IP, and query complexity
Query depth limiting and field-level permissions
API request logging with usage monitoring and anomaly detection

Building on the API? The full reference lives in the Developer Docs, including authentication and rate limits.

Compliance & Certifications

Standard	Status
PCI DSS	Card payments processed by Stripe, a certified PCI DSS Level 1 provider; mobile purchases by Apple and Google. Full card details never touch Taskade servers
Google CASA	We complete Google's Cloud Application Security Assessment for the Google API scopes we use, on the cycle Google requires. It is a Google review of that integration, not a general security certification
SOC 2 Type II	In progress; current practices are designed to align with SOC 2 requirements but no audit report exists yet
GDPR	Practices designed to align with General Data Protection Regulation principles (full compliance in progress)
CCPA	Practices aligned with California Consumer Privacy Act requirements (compliance in progress)
ISO 27001	Security management system aligned with international standards (certification in progress)

What runs today: automated dependency and vulnerability scanning on every build, plus SAST/DAST in the release pipeline. Independent third-party audits and penetration testing are part of our compliance roadmap; we are not on a fixed audit or pen-test cadence yet, and we will not claim one until we are. Where a certification we hold has a renewal cycle, we keep it current.

Report a Security Issue

We are committed to working with the security community to keep Taskade secure for everyone.

Channel	Detail
Contact	[email protected], monitored by our support team and routed to engineering
Response time	We aim for 24-48 hours for initial acknowledgment but cannot guarantee response times
Disclosure	90-day coordinated disclosure when feasible, subject to investigation requirements
Bug bounty	Private program for verified researchers. Rewards are discretionary and depend on severity, program terms, and available budget; we do not publish a reward table or guarantee a payout
Safe harbor	If you follow our program guidelines, act in good faith, stay within your own test account, and give us reasonable time to fix an issue, we will not pursue legal action against you for that research. We cannot waive claims belonging to our customers or other third parties

Recognition: on request, we credit you by name in the disclosure thread once a fix ships. We do not maintain a public researcher listing or hall of fame. Processing times vary based on complexity and available resources.

Enterprise documentation: our published security documents and control status live in our Trust Center. Anything not published there, including our current SOC 2 readiness status, is available to enterprise customers under NDA. We will share penetration test summaries once we have them. Ask us at [email protected].

Taskade is operated by Taskcade Inc., San Francisco, California, United States.

General, billing, and security questions: [email protected]
Trust Center: trust.taskade.com
System status: status.taskade.com

See also our Privacy Policy, Terms of Service, and support documents.

Security measures and policies are subject to change based on operational needs and regulatory requirements.

Got a question?

Our team reads every message and replies fast.

Loved by teams at...