Security

At TecniCubes, security is foundational to EzTask. This page outlines the measures we take to protect your data.

1. Infrastructure

• Cloud hosting: EzTask runs on industry-leading cloud infrastructure with SOC 2 compliant data centres
• Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS 1.3
• Encryption at rest: All stored data is encrypted using AES-256 encryption
• Database: MongoDB Atlas with automated backups, point-in-time recovery, and encrypted storage

2. Authentication & Access

• JWT tokens: Stateless authentication with short-lived tokens and role-based claims
• Password hashing: All passwords are hashed using bcrypt with salt rounds
• Role-based access: Provisioning Admin, Tenant Admin, Manager, Member, Viewer — each with distinct permissions
• Tenant isolation: Every API request is scoped to the authenticated tenant. Cross-tenant data access is architecturally impossible
• SSO/SAML: Available on enterprise plans for centralized identity management

3. Multi-Tenant Data Isolation

EzTask uses a shared database with tenant-level data isolation. Every document carries a tenant identifier. All queries are automatically filtered by the authenticated user's tenant context. There is no API endpoint that can return data across tenants.

Provisioning administrators (TecniCubes operations) access only tenant metadata (name, plan, subscription status) for operational management — never tenant content (tasks, billing, documents).

4. Application Security

• Input validation: All API inputs are validated and sanitized server-side
• CORS policy: Strict origin allowlisting per environment
• Rate limiting: API rate limiting to prevent abuse and DDoS
• Dependency scanning: Automated vulnerability scanning of all dependencies
• OWASP compliance: Protection against SQL injection, XSS, CSRF, and other OWASP Top 10 vulnerabilities

5. Data Backup & Recovery

• Automated daily backups with 30-day retention
• Point-in-time recovery capability
• Backups stored in geographically separate locations
• Regular restoration testing

6. Monitoring & Incident Response

• 24/7 infrastructure monitoring and alerting
• Anomaly detection for unusual access patterns
• Incident response plan with defined escalation procedures
• Post-incident reviews and public status updates for major incidents

7. Compliance

EzTask is designed with compliance in mind:

• Data processing in compliance with Indian IT Act, 2000
• GDPR-compatible data handling practices
• SOC 2 readiness (in progress)
• Regular third-party security audits

8. Vulnerability Reporting

If you discover a security vulnerability, please report it responsibly to security@tecnicubes.com. We take all reports seriously and will respond within 24 hours. We do not pursue legal action against researchers who act in good faith.

9. Contact

For security-related questions: security@tecnicubes.com