Security and privacy

ToDoddle enforces access on the server. Workspace membership, project membership, content permissions, Agent Connection scopes, and project grants are checked at request time; hidden controls are not treated as the authorization boundary.

Ordinary identity responses contain the fields needed for collaboration—such as ID, name, avatar, and role—but not email addresses. Full email is reserved for the authenticated person's own profile and authorized billing workflows. Invitation displays use masked addresses. User-authored content is not rewritten when a person intentionally types an address.

Private files use access-checked, short-lived signed URLs. Storage paths and reusable provider credentials are not returned in ordinary document responses. Direct uploads use narrowly scoped temporary authorization, and pending objects stay hidden until verified.

Agent credentials are shown once and exchanged for short-lived tokens. Scopes and project grants are applied together with the authorizing user's permissions on every call. Rotating a secret is necessary after exposure; changing grants alone does not require rotation. Agent actions retain the configured connection label and human attribution.

Accounts can use passkeys or authenticator codes for multi-factor authentication, with one-use recovery codes. Users can review and revoke active login sessions. ToDoddle stores the opaque session record ID, not the session cookie value.

Limited product analytics is opt-in by default and disabled when the browser sends Do Not Track. It records only a signed-in session start and broad page category. Automatic capture, session replay, surveys, exception capture, performance capture, and feature flags are off.

Support files and Replay recordings use private storage and case-scoped access checks. Support staff can keep internal notes and attachments that a requester cannot read. ToDoddle does not send private support files to a public malware-scanning service; it uses a strict allowlist, size and signature checks, generated storage names, and controlled retrieval.

API responses use named, validated contracts rather than returning raw database or provider objects. Security headers restrict framing, content interpretation, referrer leakage, and browser capabilities. External API CORS is intentionally separate from internal authenticated routes.

Do not put passwords, API secrets, complete connection strings, ephemeral signed URLs, or private environment contents in ToDoddle comments, Notes, Context, or support messages.

ToDoddle is not represented as SOC 2 certified. Security policy, operational evidence, and compliance-readiness work are tracked separately from product marketing claims.

See Protect your account for factor, session, and analytics controls.