Security

How r2todo is built, in the terms that matter to someone deciding whether to trust it, and how to report a problem.

Reporting a vulnerability

Email security@r2todo.com. We acknowledge within two business days. We do not pursue good faith researchers who avoid touching other people's data, do not degrade the service, and give us reasonable time to fix what they found. We credit reporters who want credit. There is no bounty programme at this time. The machine readable version of this is at https://r2todo.com/.well-known/security.txt.

How accounts are isolated

Every row in the database carries the workspace it belongs to, and the database itself, not the application, refuses to return a row to anyone who is not a member of that workspace. A test suite tries every read and write across accounts on every table and every storage path on every change to the code, and the code cannot merge if any of it gets through.

Sessions and passwords

Sessions live in cookies that scripts cannot read. Passwords are between 12 and 128 characters, checked against known breached passwords before they are accepted, and never seen by us. Optional two factor authentication with recovery codes. Changing your email, your password, connecting a calendar or mail account, changing your AI key, opening billing and deleting your account all ask for your password again.

Connected accounts and keys

Tokens for calendars and mail, and any Anthropic key you paste, are encrypted with a key that is not stored with the data. They are decrypted only at the moment R2 uses them, on our servers, and are never shown again. Disconnecting revokes the token at the provider.

The assistant

R2 proposes, you confirm. Nothing R2 does that leaves r2todo, such as a calendar event or an email, happens until you press confirm. Text R2 reads, including documents you paste, cannot make it act on its own.

Files

Attachments live in a private bucket under your workspace, are served through short lived signed links, and are checked by their contents rather than their name. Uploaded HTML and SVG are never rendered on our domain.

What we log

Request ids, routes, response codes, timings and a hashed form of your IP address. Never content. Logs are kept for 30 days.