Trust
Security at TaskFlow
TaskFlow is designed so access to Google data is narrow, server-side, encrypted, and independently authorized on every operation.
Effective September 9, 2026
Google authorization
TaskFlow requests identity information and Google Tasks access. OAuth uses PKCE, state validation, a short-lived encrypted flow cookie, and an exact callback URL. Refresh tokens are protected with authenticated encryption and never sent to the browser.
Application and database controls
Sessions are short-lived, revocable, and represented by hashed tokens in storage. Server-side authorization checks ownership or workspace membership for each operation. Database row-level security, least privilege, input validation, security headers, durable rate limits, audit events, and dependency scanning add defense in depth.
Source-of-truth safety
Google owns task content and Google-native ordering. TaskFlow stores only synchronized projections and its added planning or collaboration metadata. Mutations are durable and conflict-aware, and disconnecting or deleting TaskFlow never silently deletes Google Tasks.
Report a concern
Use the Support page to report a suspected security issue. Do not include live credentials or sensitive task contents. Reports are reviewed privately and prioritized by potential user impact.