Security Policy

Todoal takes the security of user accounts and application data seriously. This Security Policy explains the technical and organizational measures Todoal uses to protect its services, data, and infrastructure.

1. Security Approach

Todoal uses a layered security architecture designed to reduce unauthorized access, data exposure, account abuse, and application vulnerabilities. Security controls include authentication, authorization, database access controls, server-side validation, rate limiting, secure API communication, and restricted administrative access.

2. Account Authentication

Todoal uses secure authentication mechanisms to verify user accounts. Authentication credentials and identity tokens are handled through Firebase Authentication. Todoal does not expose credentials through the public application.

3. Database Security

Todoal uses server-side database security controls to protect application data, including Row Level Security (RLS) policies, database constraints, PostgreSQL triggers, and restricted database privileges. User data is isolated so authenticated users can access only their own records. Sensitive billing fields are protected from direct modification.

4. API Security

Todoal uses authenticated backend APIs and server-side validation for sensitive operations, checking authentication tokens, user identity, request parameters, subscription status, permissions, rate limits, and allowed values.

5. Payment Security

Todoal uses Paddle for subscription processing. Payment card details are processed by Paddle and are not stored by Todoal. Subscription events are received through authenticated payment webhooks and validated before updating account records.

6. Webhook Security

Webhook requests are validated using cryptographic signature verification. Webhook event identifiers are recorded to prevent duplicate replay attacks and unauthorized modifications.

7. Secret Management

Private API keys, database credentials, authentication secrets, and webhook secrets remain strictly server-side in secure environment variables, never exposed in client JavaScript or public codebases.

8. Email Security

Email delivery functionality includes controls designed to prevent duplicate delivery, excessive sending, and abuse. Scheduling limits are enforced server-side.

9. Abuse Prevention

Todoal uses rate limiting and anomaly detection to prevent excessive requests, automated abuse, spam, and brute force attempts.

10. Infrastructure Security

Todoal relies on leading infrastructure providers (Firebase, Supabase, Vercel) providing infrastructure security monitoring, encryption at rest (AES-256), access controls, automated backups, and high availability.

11. Data Transmission

All communication between client browsers and Todoal servers is encrypted in transit using HTTPS and TLS 1.2+ / TLS 1.3 protocols.

12. Administrative Access

Access to backend systems and administrative resources is restricted to authorized personnel according to least-privilege principles.

13. Security Monitoring

Todoal monitors system errors, authentication events, API requests, and technical signals to identify security anomalies, abuse, or operational failures.

14. Vulnerability Management

Application code, dependencies, configurations, and API endpoints are routinely reviewed and updated to address security advisories.

15. Third Party Services

Third-party service providers maintain their own security standards and certifications as described in our Subprocessors Policy.

16. User Security Responsibilities

Users are responsible for protecting their login credentials, using strong passwords, keeping devices updated, avoiding shared access, and reporting suspicious account activity immediately.

17. Security Incident Response

In the event of a confirmed security incident, Todoal will investigate, contain the issue, implement remediation, and notify affected users and authorities in compliance with applicable law.

18. Security Limitations

No internet service can guarantee absolute security. Users acknowledge this inherent risk when using online platforms.

19. Reporting a Security Issue

If you discover a potential vulnerability, please report it responsibly to contact@todoal.com with reproducible details without exposing user data.

20. Changes to This Security Policy

Todoal may update this Security Policy when security practices or infrastructure change. The latest version will always be published on this page.

21. Contact

For security inquiries or vulnerability disclosures, contact: