Security at TaskFlow

We operate TaskFlow as a single multi-tenant platform that places security controls at every layer — from credential handling at the browser, to request authorization at the API, to storage isolation in our data layer. Below is a summary of the core controls.

• SRP authentication

  Passwords never leave the browser. Credentials are verified via Secure Remote Password, not transmitted to our servers.

• End-to-end encryption in transit

  Every connection between the client, the API, and storage enforces TLS 1.3. The desktop application refuses to operate on older TLS versions.

• Architectural tenant isolation

  Every database record is prefixed with your organization id. Presigned S3 URLs refuse any key outside your organization prefix.

• No model training on your data

  Content inside your workspace is never used to train machine-learning models. AI summaries process only your own session data.

TaskFlow runs on Amazon Web Services in the Asia-Pacific (Mumbai) region. The backend is a Python 3.12 Lambda monolith behind Amazon API Gateway, with DynamoDB as the primary database, S3 for object storage, CloudFront for content delivery, and Secrets Manager for sensitive configuration. The web application is served by Vercel.

All production deployments are reproducible from source-controlled AWS CDK templates. Infrastructure changes follow a pull-request workflow and are verified on an isolated staging environment before reaching production.

User authentication is handled by Amazon Cognito. Passwords are never sent in plaintext — TaskFlow implements the Secure Remote Password (SRP) protocol, which exchanges only cryptographic proofs that are worthless if intercepted.

Each session issues a short-lived JSON Web Token that encodes the user’s organization id and role. On every authenticated request, the backend re-reads the user’s role from the database rather than trusting the token claim alone — so role changes take effect immediately, without the user needing to sign in again.

• In transit. TLS 1.3 is enforced for all client, API, and storage connections. Modern cipher suites are required; legacy protocols are rejected at the load balancer.
• At rest. DynamoDB and S3 storage are encrypted server-side using AWS-managed keys. Backups inherit the same encryption properties.
• Secrets. API keys, credentials for upstream services, and signing keys are stored in AWS Secrets Manager. Application code retrieves secrets at runtime; they are never written to disk or embedded in deployment artifacts.

Multi-tenancy is enforced at the data layer rather than at the application layer. Every database record is prefixed with the customer’s organization identifier, and every authenticated request carries that identifier through a request-scoped context that is impossible for application code to forge.

S3 objects are stored under an organization-scoped prefix. The presigned-URL handler validates the target key against the requesting user’s organization before signing — a request for an object outside your organization fails before a signature is ever produced.

TaskFlow implements a three-tier role model — owner, admin, and member — plus per-project memberships. Authorization is enforced at the application boundary of every endpoint. Endpoints that modify organization-wide resources require an owner or admin role and are gated by explicit authorization checks, not implicit route-prefix conventions.

Internal employee access to production data is restricted to authorized personnel on a need-to-know basis. Administrative access is audited and reviewed periodically.

We monitor the TaskFlow platform for availability, latency, and error rates. Security-relevant events — authentication failures, authorization denials, unusual access patterns — are logged to a separate stream with extended retention. Alerts are configured for anomalies that may indicate abuse or compromise.

Workspace administrators can review their own audit log from within the application, including sign-ins, role changes, and destructive actions performed by their members.

In the event of a security incident affecting customer data, we follow an internal response plan that prioritizes containment, forensics, recovery, and notification. Affected workspace administrators are notified in accordance with applicable law and the severity of the incident, typically within seventy-two (72) hours of confirmation.

We welcome reports from security researchers. If you believe you have discovered a vulnerability, please email security@neurostack.in with a detailed description, reproduction steps, and any supporting evidence. Do not disclose the issue publicly until we have had a reasonable opportunity to investigate and remediate.

We commit to responding to responsible disclosures promptly, validating the report, and communicating the outcome back to the reporter.

TaskFlow is not yet formally certified against SOC 2, ISO 27001, or comparable standards. We design our controls to meet the substance of those frameworks and are progressing toward formal attestation as the customer base expands. Enterprise customers evaluating TaskFlow can request a current security questionnaire at any time.

Reach our security team at security@neurostack.in. For general questions or customer support, contact support@neurostack.in.