Security and privacy

ToDoddle enforces access on the server. Workspace membership, project membership, content permissions, Agent Connection scopes, and project grants are checked at request time; hidden controls are not treated as the authorization boundary.

Ordinary identity responses contain the fields needed for collaboration—such as ID, name, avatar, and role—but not email addresses. Full email is reserved for the authenticated person's own profile and authorized billing workflows. Invitation displays use masked addresses. User-authored content is not rewritten when a person intentionally types an address.

Private files use access-checked, short-lived signed URLs. Storage paths and reusable provider credentials are not returned in ordinary document responses. Direct uploads use narrowly scoped temporary authorization, and pending objects stay hidden until verified.

Agent credentials are shown once and exchanged for short-lived tokens. Scopes and project grants are applied together with the authorizing user's permissions on every call. Rotating a secret is necessary after exposure; changing grants alone does not require rotation. Agent actions retain the configured connection label and human attribution.

API responses use named, validated contracts rather than returning raw database or provider objects. Security headers restrict framing, content interpretation, referrer leakage, and browser capabilities. External API CORS is intentionally separate from internal authenticated routes.

Do not put passwords, API secrets, complete connection strings, ephemeral signed URLs, or private environment contents in ToDoddle comments, Notes, Context, or support messages.

ToDoddle is not represented as SOC 2 certified. Security policy, operational evidence, and compliance-readiness work are tracked separately from product marketing claims.