Last updated 22 September 2026

Security

How each company’s work stays isolated.

1. Transport and access

Production traffic uses HTTPS. Sign-in is handled by Supabase Auth. Files sit in a private bucket and are served only after an authorised check.

2. Isolation

The database is in the European Union (Ireland, eu-west-1). Each organisation only sees its own people and work.

3. History

Completed or cancelled work is archived, not deleted. Staff cannot arbitrarily rewrite what happened. The owner can download a JSON export of the company from Settings.

4. Providers

Payments: Stripe. DutyTask never sees the full card number.

AI: OpenAI for dictation and the Daily Brief. DutyTask does not keep dictation audio.

Transactional email: Supabase Auth (invites and password reset). Application hosting: Vercel. Application data: Supabase EU. Device notifications: Web Push (VAPID), not email.

This page describes the current security setup. It is not a certification. El texto vinculante del DPA, la privacidad y las condiciones está en italiano. Esta página en inglés es una traducción de cortesía.