Trust

Security

How Pinok protects your team’s work, in plain words, and how to tell us about a problem.

Last updated

Draft — pending legal review. This page describes how Pinok works today, but it isn’t in force yet. Items in [brackets] are still to be confirmed.

In short

  • Who can see a task is decided by the database itself, with row-level security on every table, not only by the app.
  • No passwords: you sign in with a one-time email code. Access tokens last 15 minutes; refresh tokens rotate and are stored only as hashes.
  • Files are private and reached only through short-lived links, issued after checking you can open the task.
  • The web app runs under a strict content security policy and HSTS; this website runs no scripts at all.
  • We don’t claim what we haven’t confirmed: backups, encryption at rest and log retention are listed below as still to be confirmed.

How it fits together

The iPhone, Android and web apps are local-first: every change applies on your device at once and syncs in the background. They talk to one API (Node, Hono) with a Postgres database, both on Railway in the Netherlands (europe-west4). Photos and files live in a private storage bucket in Amsterdam. The server assumes an app can be modified or replaced, so every rule that matters is enforced on the server.

Access rules live in the database

  • Every request runs as the signed-in person, with row-level security on every table.
  • A project’s tasks are visible to its members; a personal task only to its creator, owner, approver and followers.
  • Database triggers check hand-offs, approvals, subtasks, project roles and history lines, so nobody can act or write history in someone else’s name.
  • Project admins and members, and the workspace owner, have only the powers their role gives them.

Signing in

  • Email codes only: no passwords to reuse or leak.
  • A code has 6 digits, is stored only as a keyed hash, works for 10 minutes and allows 5 tries.
  • Requests and wrong guesses are limited per network address and per email address, with growing lockouts.
  • Codes nobody used are deleted a day after they expire.

Sessions

  • Access tokens last 15 minutes, and every request checks that the session is still signed in.
  • Refresh tokens rotate on every use and are stored only as hashes; a session unused for 60 days ends.
  • Signing out ends the session everywhere within 30 seconds, and closes its live connections.
  • On iPhone and Android the session is kept in the Keychain or Keystore. A browser has no keychain, so the web app keeps it in local storage, protected by its strict content security policy.

Transport and headers

  • HTTPS and secure WebSockets everywhere.
  • The web app sends HSTS (two years, including subdomains), refuses to be framed, and has a content security policy that runs only its own scripts and connects only to our API, our file storage and our analytics provider.
  • This website runs no scripts at all (script-src 'none'), and its forms can post only to itself and our API.
  • Camera, microphone, location, payment and USB access are turned off for both.

Files

  • Files sit in a private bucket. Upload and download links are presigned, valid for one hour, and issued only after checking that you can open the task.
  • An upload is signed for its exact size and type (up to 25 MB; photos up to 5 MB), and nobody can overwrite someone else’s file.
  • Downloads are served as safe types: pictures, PDFs, media and text as themselves; anything else (HTML, SVG, scripts) as a download, so it can’t run as a page.
  • Files go when their task or comment does; anything left over is swept within about a day.

Push notifications

  • Pushes go only to people who can open the task, and never to the person who acted.
  • A push quotes only the actor’s own words, and its buttons repeat the app’s own checks (Approve works only for the task’s approver).
  • On iPhone, acting from a push needs an unlocked phone.
  • Pushes do carry task titles and comment text to your lock screen, through Apple or Google: that is a deliberate choice, and your phone’s settings control what shows.

The calendar feed

Calendar apps can’t sign in, so the feed’s link is the key: 32 random bytes, shown once, stored only as a hash, never logged, rate-limited and marked not to be indexed. It shows only what the app would show you. You can replace it or turn it off at any time.

Privacy by design

  • Contacts you pick a teammate from stay on your phone.
  • Analytics are not turned on. When they are, they will carry no task content, and can be turned off in Profile.
  • Error reports are scrubbed of quoted text, emails and long numbers.
  • Deleting an account leaves one audit line with the account id only.

See also Delete your account and export your data and the Privacy Policy.

What we haven’t confirmed yet

We would rather leave something out than claim it. These are still being confirmed, and we will update this page:

  • Encryption at rest for the database and the file bucket: [to confirm]
  • Database backups, how often, how long they are kept, and restore testing: [to confirm]
  • How long server and hosting logs are kept: [to confirm]
  • Who has production access, and two-factor sign-in on our service accounts: [to confirm]

Pinok has no SOC 2 or ISO 27001 certification.

Reporting a vulnerability

If you think you’ve found a security problem, please tell us privately through the contact form and choose Security. Include how to reproduce it, and please don’t access other people’s data, disrupt the service or make the problem public before we’ve fixed it. We won’t take legal action against good-faith research that follows these rules. We aim to reply within [3 business days]. Our security.txt says the same.

Questions about this page? Write to us and choose the topic that fits. All our policies are on the legal page.