Security

Your data and your clients' data

Short and specific: where we store data, who has access to it and what you can do with it.

Where the data is

In the European Economic Area.

Application and database

Servers in Frankfurt, Germany. The application and the database run there.

Attachments

Files are stored in the EU. The browser uploads them straight to file storage through a one-time signed address.

Companies kept apart

Every query in the application is limited to the organization you belong to. Company data never mixes.

Encryption and backups

In transit, at rest and in backups.

Encrypted connections

Every connection to the app and the site is encrypted (TLS).

Encrypted data

The database and files are encrypted by the providers. Access tokens for Slack, GitHub and GitLab are additionally encrypted in the application.

Backups

At most the last hour of changes can be lost (RPO ≤ 1 h), and service is restored within 4 hours (RTO ≤ 4 h).

Access and permissions

Everyone sees what they should.

Members and projects

Project members see the whole project. People outside it see only the tasks assigned to them.

Guests

A guest sees only the tasks assigned or shared with them. They don't see the team list, other tasks or other projects.

Sign-in

Sign-in through an identity server, also with a Google or Microsoft account. Guests use a one-time link valid for 30 minutes.

AI assistant

It sees only what the person who connected it sees. An administrator can turn the feature off for the whole company.

History and log

Every task change has an author and a source. Administrators have the organization's event log.

Someone leaves

Deactivation removes access within a minute. Their tasks stay where they are.

GDPR

Your company decides about the data. We process it.

Data processing agreement (DPA)

It is part of the Terms. An administrator accepts it in the app before inviting the first guest and downloads it as a PDF with version and date.

Guests' data

The company that invited a guest is the controller of the guest's data. We process it on the company's behalf.

Export

An administrator downloads the whole organization: tasks and projects as CSV and JSON, plus attachments.

Deletion

An administrator permanently deletes the organization in its settings. After the agreement ends the data stays available for 60 days, then we delete it.

Subprocessors

The full list with purpose and location is in Annex 1 to the DPA. We email administrators at least 14 days before any change.

Render Services, Inc. — hosting of the application, database and sign-in; EU (Frankfurt, Germany)
Cloudflare, Inc. (R2) — storage of attachments; EU (EU jurisdiction)
Resend (Plus Five Five, Inc.) — delivery of email notifications; EU (Ireland)
Functional Software, Inc. (Sentry) — application error monitoring; EU (Germany)

Security contact

Found a vulnerability or have a security question? Write to contact@assign2me.com. We will confirm we received your report and let you know when the issue is fixed.

Data processing agreement (DPA) · Privacy policy · Terms of service