Product
BookingsNewClasses, appointments and packs on one calendarSales and moneyNewCheckout, invoices and what came in todayClientsNewEvery client's history, forms and visitsEmail marketingNewNewsletters and automations that bring clients backAI AgentAnswers and books on WhatsApp, Instagram, Messenger, web chat and emailLeadsNewEvery enquiry on one board, with the next step and when it's dueTasksNewYour team's to-dos, made for you when leads and bookings changeSocialNewPlan and publish your postsReportsNewSales, bookings and clients at a glanceAI AutomationsWorkflows that run themselves, without losing qualityAI-Powered CreativeSenior creative, faster, with AI in the loop
Performance
Google AdsSearch, PMax and YouTube, priced by the workMeta AdsFacebook and Instagram with creative that keeps winningDigital AdsMeta, Google and TikTok campaigns that convertSocial Media CreativeReels, carousels and content for every platformKOL ManagementInfluencer strategy and execution, end to endSEOOrganic growth that compounds month over month
Creative and brand
Video and Media ProductionBrand films, reels and content at speedBranding and StrategyPositioning, messaging, identity and guidelinesEmail CreationEmails people open, read and buy fromWeb DevelopmentWebsites and landing pages built to sellApp DevelopmentMVP to store-ready, fixed price and date
Try it now
doTask ChatbotTalk to the AI AgentAsk it anything about doTask — it answers from our own pages and hands over to a person when it should.Open the chat →Book a demo
Home › Security
Security

Security and incident response

Your clients' conversations, bookings and payments are walled off per workspace, encrypted, and watched. This page is our policy, word for word.

Effective: 15 September 2026Last updated: 18 October 2026doTask · Kuala Lumpur, Malaysia
Zack Lam
Authored by Zack LamFounder, doTask
EncryptedHTTPS everywhere; AES-256 at rest; connected-platform credentials encrypted again with AES-256-GCM.Walled off per workspaceRow-level security on every table: staff only ever read their own workspace.Signed webhooksEvery message from WhatsApp, Instagram, Shopify, Stripe and email is checked before it is accepted.Two-step sign-inAuthenticator apps for every member; owners can require it for the whole team.Daily backupsEncrypted daily backups; deleted data leaves them within 30 days.Incident responseA written plan for what we do, and who we tell, when something goes wrong.

Scope

This page describes how doTask protects the data held in the doTask Chatbot — the dashboard at app.dotask.io, the messaging service at chatbot.dotask.io, the website chat widget, the hosted chat and booking pages, and the Shopify app — and what we do when something goes wrong. It complements the Privacy Policy, which says what data we hold and why.

"Personal data" here means anything that identifies a client's customer or can be linked back to them: a name, an email address, a phone number, a message, an order number, a booking.

How data is protected

  • In transit: every connection is HTTPS. The dashboard sets a strict Content Security Policy, so only scripts we ship can run on it.
  • At rest: the database, file storage and backups (Supabase, Singapore region) are encrypted at rest with AES-256 by the provider, as is marketing email held by Amazon SES (Sydney). Credentials for connected platforms (WhatsApp, Instagram, Shopify, Google, Notion and others) are encrypted again by doTask with AES-256-GCM before they are stored, with a key kept in our servers' protected settings and never in the database.
  • Per workspace: every table enforces row-level security. A client's staff can only read their own workspace; there is no shared query path across clients.
  • Inbound messages: every webhook from WhatsApp, Instagram, Shopify, Stripe and email is checked against the platform's signature before it is accepted. Unsigned or mis-signed requests are rejected and logged.
  • Abuse limits: per-address and per-workspace rate limits on every public endpoint, a request-size cap, and an edge rule that blocks an address sending an unusual volume of writes.
  • Sign-in: passwords are at least 10 characters, are checked against known leaked passwords, and are never stored by us (Supabase Auth hashes them); sign-in is protected against automated attempts; every member can add an authenticator app, and a workspace owner can require two-step sign-in for everyone.

What encryption covers

Encryption protects data on the way to us and while it is stored. It does not stop doTask's own service from reading messages, because the service has to: to deliver a message to WhatsApp, Instagram, Messenger or email, to let the AI Agent answer from the business's own knowledge, to search the inbox and to run automations. So doTask is not end-to-end encrypted, and we do not describe it that way. The same is true of the messaging platforms' business interfaces: WhatsApp's business platform, for example, decrypts a customer's message before passing it to the business's software.

What keeps that access narrow is everything else on this page: each workspace walled off from every other, who on a team can see which areas, signed messages from the platforms, and the limits on doTask staff below.

Who can see what

A client decides who on their team sees which areas (inbox, bookings, customers, email, AI Agent, analytics, settings) through roles and per-member permissions. Every change a member makes is recorded in the workspace's activity log.

doTask staff do not look at a client's data in the course of normal operation. We access it only to resolve a support request the client has raised, or to investigate a security incident. Access to the production systems is limited to doTask's founder; doTask's internal admin console needs a passkey, signs out after 30 minutes without use, and records every action in a log that cannot be changed without it showing. We never sell personal data and never use it to train AI models.

Backups and data loss

  • The database is backed up daily by Supabase; backups are encrypted at rest and kept for 7 days.
  • Data a client deletes, or that a customer asks us to erase, leaves the backups within 7 days.
  • Uploaded files live in encrypted object storage. Files sent in conversations and images used in emails or the chat widget are kept at long, unguessable web addresses so they can be shown in messages; client photos, files attached to tasks and receipts are private and open only through short-lived links for the business's own team.

Incident response

A security incident is any event where personal data may have been read, changed or lost by someone who should not have had it — a compromised account, a mis-scoped query, a leaked credential, a provider breach, or an attack on our infrastructure.

  1. Detect. Monitoring on the messaging service and the database, provider alerts (Cloudflare, Vercel, Supabase, Stripe, Meta, Shopify), the dashboard's activity log, and reports from clients or researchers.
  2. Triage within 24 hours. The owner is told immediately. Within 24 hours of first notice we establish what happened, which workspaces and which data are affected, and whether it is ongoing.
  3. Contain. Rotate the affected credentials, revoke sessions, block the source, disable the affected path if needed — before anything else. The product is built so a single key can be rotated without downtime.
  4. Notify — see below.
  5. Recover and review. Restore from backup where data was lost, then write a post-incident review: cause, timeline, what changed to stop it recurring. Affected clients receive the review.

Who we tell, and when

  • Affected clients: by email to the workspace owner within 72 hours of confirming that their customers' personal data was affected, with what happened, what data, and what we did. Sooner when the incident is ongoing.
  • Authorities: for personal data doTask holds for itself, the Personal Data Protection Commissioner within 72 hours where the Malaysian Personal Data Protection Act 2010 requires it, and the people affected within 7 days after that. For the data we hold for a client, we tell the client at once and give them what they need to notify the Commissioner and their customers on the same timetable. For clients in the UK or EU, the UK GDPR and EU GDPR apply (72 hours to the supervisory authority).
  • Platforms: Shopify, Meta and Stripe as their partner terms require, where an incident touches data obtained through them.

Reporting a vulnerability

If you believe you have found a security problem in doTask, write to [email protected] with "Security" in the subject. We acknowledge within two working days and keep you informed until it is fixed. Please do not access, change or keep any data that is not yours while testing, and give us reasonable time to fix the issue before disclosing it.

Data Protection Officer

doTask's Data Protection Officer is Zack Lam, at [email protected]. Write to that address about how we handle personal data, to exercise your rights, or to report a personal data breach.

Certification

We are working towards ISO/IEC 27001 certification for the doTask platform: the dashboard, the messaging service, the chat widget, the hosted pages and the Shopify app. We are not certified yet, and this page will say so, with the certifying body, once we are. The providers we build on hold their own independent certifications, listed in the Privacy Policy's list of service providers.

Changes

We update this page when our practices change. The date at the top is the date of the last change.