Security questions answered

These are the questions security teams send us after procurement is happy. If your questionnaire asks something that is not here, send it over during scoping and we will answer it. Where the answer is no, we say no: see Are you SOC 2 or ISO 27001 certified? below.

Is our data encrypted at rest?

Yes, twice over. OneTaskList encrypts the sensitive fields itself before they are stored: task titles, notes and tags, people’s names and email addresses, and the tokens for your connected tools. Azure then encrypts the databases, storage and backups underneath.

Is it encrypted in transit?

Yes. Browsers reach your region over HTTPS, and inside the region the app talks to its database, storage and cache over TLS 1.2.

Who holds the encryption keys?

Your region does. The encryption keys live in your region’s own storage, protected by a key held in your region’s Key Vault, and no other customer’s region can reach either. If your region runs in your Azure subscription, that vault is yours and you can see every access to it.

Can we supply our own keys?

The keys are generated for your region rather than supplied by you. If your policy requires customer-managed keys, raise it during scoping and we will tell you what we can do for your region before you sign anything.

How do you handle multi-factor authentication?

Your identity provider does. OneTaskList never sees a password or a second factor, so whatever you enforce there, including conditional access and device rules, applies to OneTaskList too.

How long does a session last?

A signed-in session is renewed quietly in the background for up to 14 days of continued use. With single sign-on, the session itself ends after 24 hours by default and you can set any length up to a week. Signing out ends it immediately.

Where are tokens kept in the browser?

In the tab’s session storage, which the browser clears when the tab closes. They are not kept in a long-lived cookie, so they do not travel with other requests to our domain.

Who at OneTaskList can see our data?

Only the engineers who run and support your region, through Azure, and only when running it or answering a support request. Task titles, notes, tags and tool tokens are encrypted by the application, so they are not readable by browsing the database. If your region runs in your own Azure subscription, you grant that access, you can watch it in your own logs, and you can withdraw it.

Can we restrict access to our network?

Your region is reached over the public internet, the same way your people reach Microsoft 365. If you need IP restrictions or private networking, bring it to scoping: it changes how your region is built, so it has to be agreed before we deploy it.

Does our task data go to an AI provider?

Only if someone turns the assistant on, and only for what they ask about. It is off until a person adds their own provider key. From then on their browser talks to Anthropic or OpenAI directly: the task content goes from their browser to the provider, so it does not pass through our servers, and it does leave your region. Nobody who has not added a key sends anything anywhere.

Where is the AI key stored?

In that person’s own browser. It is never sent to OneTaskList, so we cannot read it, use it or bill against it.

Can we stop people using it?

Tell us at scoping and we will tell you what we can switch off for your region. Without a provider key of their own, nothing leaves your region through the assistant.

Are you SOC 2 or ISO 27001 certified?

No, and we would rather tell you now than halfway through a review. We do not hold a SOC 2 or ISO 27001 report today. What we offer instead is verifiable rather than attested: your region can run in your own Azure subscription where you see every resource, your own app registrations can hold the keys to every tool, your identity provider decides who gets in, and the commitments we make go into your contract.

Will you complete our security questionnaire?

Yes. Send it during scoping. We answer it ourselves rather than pointing you at a portal, and we will tell you plainly where the answer is no.

Will you sign a data processing agreement?

Yes. Ours or yours, as part of the contract, naming the sub-processors below and what each one is for.

Who are your sub-processors?

Microsoft Azure hosts your region, Microsoft 365 carries internal alerts to our team about new sign-ups, and browser push services deliver notifications to people who turn them on. The full list, with what each one does and where, is at onetasklist.com/subprocessors. The tools your own people connect, and an AI provider a person chooses with their own key, are not our sub-processors. When card payments for paid plans arrive, a payment provider will handle them, and it will never receive your task data.

What happens if there is a security incident?

We tell your named contacts what happened, what it touched and what we are doing about it. The notification period is written into your contract, so you are not relying on goodwill.

How do we report a vulnerability?

Email info@onetasklist.com with the detail and how to reproduce it. We will confirm we have it, keep you posted while we fix it, and credit you if you would like us to.

How are backups handled?

Tasks can be restored to any point in the last 30 days. Attachments are kept for 30 days after deletion and are stored redundantly. Boards and connections use Azure SQL’s standard backups. Retention and recovery targets are written into your contract.

What happens when someone deletes their account?

Their boards, tasks and connections are deleted straight away, not flagged for deletion later. Backups age out on the schedule above.

Can we get our data out?

Yes. Each person can download their own data from the app at any time, and we will export a whole region for you on request, in a format we agree.

What happens at the end of the contract?

We export your data, hand it over, and remove your region. If it runs in your Azure subscription, you keep the resources and simply withdraw our access.

• Where your data lives, for residency and what leaves your region.
• Bring your own app registrations, to hold the keys to every connected tool yourself.
• Allow-list or single sign-on, for who can reach your region.
• Data and security, the short version for everyone else.