Security

Production traffic uses HTTPS. Sign-in is handled by Supabase Auth. Files sit in a private bucket and are served only after an authorised check.

The database is in the European Union (Ireland, eu-west-1). Each organisation only sees its own people and work.

Completed or cancelled work is archived, not deleted. Staff cannot arbitrarily rewrite what happened. The owner can download a JSON export of the company from Settings.

Payments: Stripe. DutyTask never sees the full card number.

AI: OpenAI for dictation, the Daily Brief, and indexing of Clients files the studio chooses to archive. DutyTask does not keep dictation audio. There is no assistant that replies in chat.

Transactional email: Resend (sign-up confirmation, credentials, password recovery), sending from Ireland. Authentication: Supabase Auth. Application hosting: Vercel. Application data: Supabase EU. Device notifications: Web Push (VAPID), not email.