Taskboard Security & Compliance

Waymaker taskboards are built with security and compliance as foundational principles. This guide covers our security architecture, data protection measures, access controls, and compliance certifications.

Security Architecture

Multi-Layer Security Model

1. Infrastructure Layer

• Enterprise cloud infrastructure (SOC 2 certified)
• Enterprise-grade DDoS protection
• Network isolation and VPC segmentation
• Automated security patching

2. Application Layer

• Secure coding practices and code review
• Regular security audits and penetration testing
• OWASP Top 10 protection
• Input validation and sanitization

3. Data Layer

• Encryption at rest (AES-256)
• Encryption in transit (TLS 1.3)
• Database-level access controls
• Automated backups with encryption

4. Access Layer

• Multi-factor authentication (MFA)
• Role-based access control (RBAC)
• Session management and timeouts
• IP allowlisting (Enterprise)

Data Encryption

Encryption at Rest

All data stored in Waymaker is encrypted using industry-standard AES-256 encryption.

Encrypted Data:

• Task content and descriptions
• Comments and discussions
• File attachments
• User profile information
• Organization settings
• API keys and secrets

Key Management:

• Managed key management service (KMS)
• Automatic key rotation every 90 days
• Separate keys per environment (production, staging)
• Master keys stored in hardware security modules (HSM)

Database Encryption:

Database Transparent Data Encryption (TDE)
├── Data files encrypted with AES-256
├── Write-ahead log encryption
├── Backup encryption
└── Index encryption

Encryption in Transit

TLS 1.3 Everywhere:

• All API requests over HTTPS only
• WebSocket connections use WSS (TLS)
• HTTP requests redirected to HTTPS
• Perfect Forward Secrecy (PFS)

Certificate Management:

• Automated certificate renewal via Let's Encrypt
• Certificate pinning for mobile apps
• HSTS (HTTP Strict Transport Security) enabled
• TLS 1.2 minimum (1.3 preferred)

API Security:

Client Request
    ↓ TLS 1.3 Handshake
    ↓ Certificate Validation
    ↓ Encrypted Channel
API Gateway
    ↓ DDoS Protection
    ↓ Rate Limiting
    ↓ Request Validation
Application Servers
    ↓ Authentication
    ↓ Authorization
    ↓ Business Logic
Database (Encrypted at Rest)

Access Control

Authentication

Supported Methods:

• Email + Password: Minimum 12 characters, complexity requirements
• OAuth 2.0: Google, Microsoft, GitHub integrations
• SAML 2.0: Enterprise SSO (Enterprise plan)
• Multi-Factor Authentication (MFA): TOTP-based (Google Authenticator, Authy)

Password Policy:

• Minimum length: 12 characters
• Complexity: Uppercase, lowercase, numbers, special characters
• Password history: Cannot reuse last 5 passwords
• Expiration: Optional (90-day rotation for Enterprise)
• Breach detection: Integration with HaveIBeenPwned

Session Management:

// Session security features
{
  "session_timeout": "8 hours",
  "idle_timeout": "30 minutes",
  "max_concurrent_sessions": 5,
  "secure_cookie": true,
  "httpOnly_cookie": true,
  "sameSite": "strict",
  "session_rotation": "on_auth_change"
}

MFA Enforcement:

• Organization owners can enforce MFA for all members
• MFA required for sensitive operations (API key creation, billing)
• Backup codes provided for account recovery
• Support for hardware security keys (YubiKey)

Authorization

Role-Based Access Control (RBAC):

Organization Roles:

Owner
├── Full organizational control
├── Billing and subscription management
├── Security settings and MFA enforcement
├── Can delete organization
└── Transfer ownership

Admin
├── Manage members and teams
├── Create and delete boards
├── Configure organization settings
├── View audit logs
└── Cannot modify billing or delete organization

Member
├── Access assigned boards
├── Create and edit tasks
├── Collaborate on projects
└── Limited organizational visibility

Guest
├── Limited board access (explicitly invited)
├── View and comment only (configurable)
├── No organizational visibility
└── No member management

Board-Level Permissions:

Owner
├── Full board control
├── Manage board members
├── Configure board settings
├── Archive/delete board
└── Cannot be removed from board

Editor
├── Create and edit all tasks
├── Manage layers and sections
├── Add comments and attachments
├── Invite viewers/commenters
└── Cannot manage board settings

Viewer
├── View all tasks and comments
├── Export and print
├── Subscribe to notifications
└── Cannot edit or comment

Commenter
├── View all tasks
├── Add comments
├── React to comments
└── Cannot edit tasks

Granular Permissions:

{
  "board_permissions": {
    "can_create_tasks": true,
    "can_edit_tasks": true,
    "can_delete_tasks": false,
    "can_manage_members": false,
    "can_export_data": true,
    "can_configure_integrations": false
  },
  "task_permissions": {
    "can_assign_tasks": true,
    "can_change_priority": true,
    "can_set_due_dates": true,
    "can_add_attachments": true,
    "can_delete_comments": false
  }
}

Data Access Rules

Database-Level Access Control:

Waymaker enforces access rules at the database level, ensuring data isolation even if application logic is compromised.

Organization Isolation:

-- Users can only access data from their organizations
CREATE POLICY "organization_isolation"
ON tasks FOR ALL
USING (
  board_id IN (
    SELECT b.id FROM boards b
    JOIN organization_members om ON b.organization_id = om.organization_id
    WHERE om.user_id = auth.uid()
  )
);

Board Access:

-- Users can only access boards they're members of
CREATE POLICY "board_access"
ON boards FOR SELECT
USING (
  id IN (
    SELECT board_id FROM board_members
    WHERE user_id = auth.uid()
  )
  OR
  organization_id IN (
    SELECT organization_id FROM organization_members
    WHERE user_id = auth.uid()
  )
);

Guest Access Restrictions:

-- Guests can only access explicitly shared boards
CREATE POLICY "guest_board_access"
ON boards FOR SELECT
USING (
  id IN (
    SELECT board_id FROM board_members
    WHERE user_id = auth.uid()
      AND user_id IN (
        SELECT user_id FROM organization_members
        WHERE role = 'guest'
      )
  )
);

Audit Logging

Activity Tracking

Logged Events:

• User authentication (login, logout, failed attempts)
• Organization changes (settings, member additions/removals)
• Board operations (create, update, delete, archive)
• Task modifications (create, update, move, delete)
• Permission changes (role updates, access grants)
• API key operations (create, revoke)
• Export and data download operations
• Security setting changes (MFA, SSO configuration)

Audit Log Format:

{
  "event_id": "evt_abc123...",
  "event_type": "task.deleted",
  "timestamp": "2025-01-10T15:30:00Z",
  "actor": {
    "user_id": "user_uuid_123",
    "email": "user@example.com",
    "ip_address": "192.168.1.1",
    "user_agent": "Mozilla/5.0..."
  },
  "resource": {
    "type": "task",
    "id": "task_uuid_456",
    "board_id": "board_uuid_789",
    "organization_id": "org_uuid_abc"
  },
  "changes": {
    "before": {
      "title": "Old task title",
      "status": "In Progress"
    },
    "after": null
  },
  "metadata": {
    "source": "web_app",
    "session_id": "session_123"
  }
}

Audit Log Retention:

• Standard: 90 days
• Pro: 1 year
• Enterprise: 7 years (configurable)

Audit Log Access:

Organization Owners
├── Full audit log access
├── Export to CSV/JSON
├── Filter by date, user, event type
└── SIEM integration (Enterprise)

Organization Admins
├── Read-only audit log access
├── Export to CSV/JSON
└── Limited filtering

Members
└── No access (privacy protection)

Real-Time Monitoring

Security Monitoring:

• Anomalous login patterns
• Unusual API activity
• Large data exports
• Multiple failed authentication attempts
• Permission changes
• New device/location logins

Automated Alerts:

Critical Events (Immediate)
├── Multiple failed login attempts (5+ in 10 minutes)
├── API key compromised (detected usage from multiple IPs)
├── Bulk data export (>1000 tasks)
└── Organization deletion initiated

Warning Events (Daily Summary)
├── New device login
├── New IP location
├── Permission changes
└── Member additions/removals

Data Protection

Data Residency

Available Regions:

• United States (US-EAST-1, US-WEST-2)
• Europe (EU-WEST-1 - Ireland, EU-CENTRAL-1 - Frankfurt)
• Asia Pacific (AP-SOUTHEAST-1 - Singapore) - Coming Soon

Region Selection:

• Chosen during organization creation
• Cannot be changed after creation (requires migration)
• All data stored in selected region
• Backups stored in same region

Data Transfer:

• Cross-region transfers only with explicit consent
• EU data never transferred to US (GDPR compliance)
• Data sovereignty guarantees for Enterprise customers

Data Backup & Recovery

Backup Strategy:

Continuous Backups
├── Point-in-time recovery (30 days)
├── Automated snapshots every 6 hours
├── Encrypted backups (AES-256)
└── Geographic redundancy (multi-AZ)

Long-Term Retention
├── Weekly backups (90 days)
├── Monthly backups (1 year)
├── Annual backups (7 years) - Enterprise
└── Compliance archive (custom retention)

Recovery Options:

• Self-service task/board restore (last 7 days)
• Organization-level restore (contact support)
• Point-in-time recovery (Enterprise, last 30 days)
• Disaster recovery: <4 hour RTO, <1 hour RPO

Backup Testing:

• Quarterly disaster recovery drills
• Backup integrity validation
• Restore testing in isolated environment

Data Deletion

Soft Delete (Default):

• Tasks marked as deleted, not permanently removed
• Recoverable for 30 days
• Automatic permanent deletion after 30 days

Hard Delete (Explicit):

• Immediate permanent deletion
• Cannot be recovered
• Requires confirmation
• Audit log retained

Account Deletion:

User Account Deletion
├── Immediate: Personal data removed
├── 30 days: Tasks reassigned or anonymized
├── 90 days: Comments anonymized
└── Audit logs retained per compliance

Organization Deletion
├── 7-day grace period
├── All members notified
├── Export all data option
├── Permanent deletion after grace period
└── Backup retained per compliance (30 days)

Compliance

SOC 2 Type II

Certification Status: Certified (annual audit)

Trust Service Criteria:

• ✅ Security: Data protection and access controls
• ✅ Availability: 99.9% uptime SLA
• ✅ Processing Integrity: Accurate and complete processing
• ✅ Confidentiality: Protection of confidential information
• ✅ Privacy: Personal information handling

Annual Audit:

• Independent third-party auditor
• Report available to Enterprise customers
• Continuous monitoring and improvement

GDPR Compliance

Data Protection Principles:

• ✅ Lawfulness, Fairness, Transparency: Clear privacy policy and terms
• ✅ Purpose Limitation: Data used only for stated purposes
• ✅ Data Minimization: Collect only necessary data
• ✅ Accuracy: Mechanisms to update and correct data
• ✅ Storage Limitation: Retention policies and automated deletion
• ✅ Integrity and Confidentiality: Encryption and access controls

GDPR Rights:

Right to Access
├── Self-service data export
├── Download all personal data
└── Machine-readable format (JSON)

Right to Rectification
├── Edit profile information
├── Update email and preferences
└── Correct inaccurate data

Right to Erasure ("Right to be Forgotten")
├── Delete account option
├── 30-day processing time
└── Exceptions for legal obligations

Right to Data Portability
├── Export to JSON/CSV
├── API access for automated export
└── Transfer to another service

Right to Object
├── Opt-out of marketing communications
├── Opt-out of analytics (non-essential)
└── Object to automated decision-making

Data Processing Agreement (DPA):

• Standard DPA available for all customers
• EU Standard Contractual Clauses (SCCs)
• GDPR-compliant subprocessor list
• Subprocessor change notifications

CCPA Compliance

California Consumer Privacy Act:

• ✅ Right to know what data is collected
• ✅ Right to delete personal information
• ✅ Right to opt-out of data sales (we don't sell data)
• ✅ Non-discrimination for exercising rights

CCPA Request Process:

1. Submit request via Settings → Privacy → CCPA Request
2. Identity verification (email + optional MFA)
3. Request processing (45 days maximum)
4. Data delivered or deletion confirmed

HIPAA Compliance (Enterprise)

Business Associate Agreement (BAA):

• Available for Enterprise customers
• Required for healthcare organizations
• Enhanced security controls
• Regular compliance audits

HIPAA Safeguards:

• Administrative: Policies, training, risk assessments
• Physical: Data center security, device management
• Technical: Encryption, access controls, audit logs

Not Recommended For:

• Direct patient care coordination
• Storage of medical records
• Protected Health Information (PHI) in task descriptions

Use Cases:

• Healthcare IT project management
• Administrative workflows
• Non-clinical team collaboration

Industry-Specific Compliance

ISO 27001 (In Progress):

• Information Security Management System
• Expected certification: Q2 2025

PCI DSS:

• Not applicable (we don't store payment card data)
• Stripe handles all payment processing (PCI compliant)

Security Best Practices

For Organization Owners

✅ Enforce MFA for all members ✅ Regular access reviews (quarterly) ✅ Principle of least privilege for permissions ✅ Monitor audit logs for suspicious activity ✅ IP allowlisting for sensitive organizations (Enterprise) ✅ SSO integration for centralized identity (Enterprise) ✅ Security training for all team members ✅ Incident response plan documented and tested

For Board Owners

✅ Review board members regularly ✅ Limit guest access to specific tasks/boards ✅ Use granular permissions appropriately ✅ Disable public sharing unless necessary ✅ Remove inactive members promptly ✅ Monitor board activity for anomalies

For All Users

✅ Use strong, unique passwords (password manager) ✅ Enable MFA on your account ✅ Don't share credentials (use proper access controls) ✅ Log out from shared devices ✅ Report suspicious activity immediately ✅ Keep software updated (browser, OS) ✅ Be cautious with attachments from unknown sources ✅ Use approved devices for accessing sensitive data

Incident Response

Security Incident Process

1. Detection:

• Automated monitoring and alerts
• User reports via security@waymakerone.com
• Bug bounty program submissions

2. Assessment:

• Severity classification (Critical, High, Medium, Low)
• Impact analysis (data, users, services)
• Initial containment measures

3. Containment:

• Isolate affected systems
• Revoke compromised credentials
• Block malicious activity

4. Investigation:

• Root cause analysis
• Scope determination
• Evidence collection

5. Remediation:

• Apply security patches
• Update access controls
• Implement additional safeguards

6. Communication:

• Affected users notified (within 72 hours for GDPR)
• Regulatory notifications (if required)
• Public disclosure (if material impact)

7. Post-Incident Review:

• Lessons learned documentation
• Process improvements
• Security enhancement implementation

Reporting Security Issues

Contact:

• Email: security@waymakerone.com
• PGP Key: Available at waymakerone.com/security.txt
• Bug Bounty: HackerOne program

Response Time:

• Critical: 4 hours
• High: 24 hours
• Medium: 72 hours
• Low: 1 week

Disclosure Policy:

• Coordinated disclosure (90 days)
• Credit to researcher (if desired)
• Bug bounty rewards (based on severity)

Third-Party Security

Subprocessors

Infrastructure:

• Cloud hosting with global CDN (330+ edge locations)
• DDoS protection and edge security

Services:

• Stripe (payment processing)
• Transactional email delivery
• AI features (optional)

Full Subprocessor List: Available at waymakerone.com/subprocessors

Security Assessments

All subprocessors must meet our security standards:

• SOC 2 Type II certification (or equivalent)
• GDPR compliance
• Data Processing Agreement (DPA)
• Regular security audits
• Incident response plan

Privacy

Data Collection

We Collect:

• Account information (name, email)
• Usage data (features used, login times)
• Device information (browser, OS, IP address)
• Content you create (tasks, comments, attachments)

We Don't Collect:

• Personal browsing history
• Data from other websites
• Contact lists (unless you import)
• Financial information (handled by Stripe)

Data Usage

How We Use Data:

• Provide and improve the service
• Communicate with you (support, updates)
• Analyze usage patterns (aggregated, anonymized)
• Prevent fraud and abuse
• Comply with legal obligations

We Don't:

• Sell your data to third parties
• Use your data to train AI models (without explicit consent)
• Share data with advertisers
• Access your data without permission (except legal requirements)

Data Sharing

We Share Data With:

• Subprocessors (for service delivery)
• Legal authorities (when required by law)
• Acquirer (in event of merger/acquisition, with notice)

We Don't Share:

• Your data with competitors
• Personal information with marketing partners
• Content with AI companies (for training)

Conclusion

Waymaker taskboards are built with security and compliance as core principles:

• Enterprise-grade security with encryption, access controls, and monitoring
• Compliance certifications including SOC 2, GDPR, CCPA
• Transparent practices with clear policies and audit logs
• Continuous improvement through regular audits and security testing
• User control over data with export, deletion, and privacy rights

Your data security and privacy are our top priorities.

Related Resources

• API & Webhooks - Secure API integration
• Data Model - Understanding data architecture
• Inviting Members - Managing team access
• Privacy Policy - Detailed privacy information
• Security Page - Security overview and contact

---

Last updated: January 10, 2025