Skip to main content

Data Protection

Data handling practices, GDPR compliance, and privacy controls.

Data Classification​

ClassificationExamplesProtection
CriticalPasswords, JWT secretsEncrypted, never logged
SensitivePII, email, phoneEncrypted at rest, access controlled
InternalTime logs, projectsTenant-isolated
PublicOrganization nameNo restrictions

GDPR Compliance​

Data Subject Rights​

RightImplementation
Right to AccessExport user data via API
Right to RectificationEdit profile endpoints
Right to ErasureAccount deletion with cascade
Right to PortabilityData export in JSON/CSV
Right to RestrictionAccount deactivation

Data Minimization​

  • Collect only necessary information
  • Default to Optional for non-critical fields
  • Configurable screenshot retention periods
  • Auto-cleanup of expired data

Encryption​

At Rest​

DataMethod
Passwordsscrypt (default) with transparent bcrypt fallback for legacy hashes
DatabaseTDE (Transparent Data Encryption)
File storageS3 server-side encryption
tip

Passwords are progressively migrated from bcrypt to scrypt on login. See Password Security for details.

In Transit​

ChannelMethod
API requestsTLS 1.2+
Database connectionsSSL
WebSocketWSS

File Storage Security​

All file storage providers (AWS S3, DigitalOcean Spaces, Wasabi, Cloudinary, Local) use structured logging:

  • No credential leaks — API keys, secret keys, and full configuration objects are never logged.
  • Error logging uses Logger.error() with message-only output.
  • Debug logs use safe messages (e.g., "S3 configuration loaded" instead of JSON.stringify(config)).

Data Retention​

Data TypeDefault Retention
ScreenshotsConfigurable
Activity logs12 months
Time logsIndefinite
Audit logs24 months
Deleted accounts30 days (soft delete)