Security at TodoTicked

1. Overview

TodoTicked is built by Phoenix Digital, LLC. We take a defense-in-depth approach: encrypted transport, authenticated access, database row-level security, optional two-factor authentication, optional client-side encryption for sensitive notes, and self-service export/deletion controls.

This page describes controls that exist in our codebase and production architecture. It does not claim certifications or enterprise capabilities we do not operate ourselves.

2. Authentication

• Secure email/password authentication with password hashing handled by the auth provider.
• Google Sign-In and Sign in with Apple via OAuth.
• Optional TOTP two-factor authentication with backup codes, managed in Settings → Security.
• Session management so you can review and revoke active sessions.
• Bot protection with reCAPTCHA Enterprise on email sign-in and sign-up flows.
• Fresh authentication checks for sensitive actions such as data export and account deletion.

3. Encryption in Transit and Platform Storage

• All TodoTicked web properties and API traffic are served over HTTPS/TLS.
• Application data is hosted on secure PostgreSQL infrastructure. Platform-level storage encryption and operational security are provided by our infrastructure vendors.
• Default application content (such as tasks and most metadata) is protected by authentication and row-level security; it is not client-side end-to-end encrypted.

4. Optional End-to-End Encryption (Notes)

TodoTicked offers optional client-side encryption for notes in encrypted folders. This is designed so that encrypted content is stored as ciphertext and encryption keys are derived and held on your devices.

• Algorithms: AES-256-GCM for content; PBKDF2-SHA256 to derive a key encryption key from your passphrase.
• Key model: a master encryption key (MEK) is generated on your device and stored only in wrapped form on our servers.
• Recovery: a one-time recovery code can wrap a backup of your MEK. If you lose both your passphrase and recovery materials, we cannot decrypt that content.
• Quick Unlock: on supported devices, WebAuthn/platform biometrics can unlock the local encryption session (this is not a substitute for account login).

5. Data Access Controls

• Row Level Security (RLS) on user data tables so accounts can access only data they own or that has been explicitly shared with them.
• Team and project sharing uses explicit membership and role policies.
• Soft delete with a recycle bin; soft-deleted items are typically purged after about 30 days by retention jobs.
• Security headers on the web app (including CSP-related controls, frame denial, and MIME sniffing protections).

6. Payments

Web subscriptions are processed by Stripe using hosted checkout and customer portal flows. TodoTicked stores customer and subscription identifiers, not card numbers. Apple App Store purchases are billed by Apple; we receive entitlement/status information needed to unlock paid features.

Stripe webhook endpoints verify signatures before applying subscription changes.

7. API and Webhooks

• Programmatic access via scoped personal access tokens and OAuth 2.1 with PKCE.
• API requests are rate-limited.
• Outbound webhooks are signed (HMAC) and include protections against common SSRF abuse patterns.

8. Infrastructure Partners

The marketing site and web app are served via Cloudflare. Application Data, authentication, storage, and backend functions run on secure managed infrastructure. We use monitoring tools such as Sentry (and LogRocket in production) to diagnose errors and improve reliability.

Our infrastructure partners maintain their own compliance programs (for example SOC 2 or ISO certifications). Those certifications belong to the vendors, not to TodoTicked as a company certification unless separately stated.

9. Privacy Controls You Can Use

• Export your data from Settings → Security (rate-limited; requires a recent login).
• Delete your account from Settings → Security (confirmation required; cancels associated Stripe subscriptions when applicable).
• Review our Privacy Policy and Privacy Choices.

10. What We Do Not Claim

To stay accurate, we do not claim that:

• TodoTicked itself is SOC 2 or ISO 27001 certified
• All user data is end-to-end encrypted by default
• We operate a 24/7 staffed security operations center
• We provide SMS 2FA, passkey-based account login, or certificate pinning
• We store or can recover E2EE plaintext without your keys

If you see older marketing copy that conflicts with this page, treat this Security page and the Privacy Policy as the source of truth.

11. Vulnerability Disclosure

If you believe you have found a security vulnerability in TodoTicked, including the TodoTicked Slack app, Edge Functions, APIs, or related services, please email security@todoticked.com with enough detail for us to reproduce the issue. Please give us a reasonable time to investigate and remediate before public disclosure.