Security
The TaskLoop website uses HTTPS, security headers and minimal data collection. If you find a vulnerability, email dev@rozamoon.com and we will work with you to fix it.
How the website is protected
This section covers the public TaskLoop website. Product security is covered further down.
- HTTPS everywhere. All pages and forms are served over encrypted HTTPS connections.
- Security headers. The website sends browser security headers, such as a content security policy, to limit what can run on the page and reduce the risk of attacks like cross-site scripting.
- Minimal data collection. The forms ask only for what we need to reply: name, email, company and, optionally, phone and a message. The website uses self-hosted, cookie-free analytics and sets no tracking cookies.
- Spam and abuse protection. The forms include checks against automated submissions and repeated requests.
For what we collect and why, see the privacy policy and the cookie policy.
Product security
Details on how the TaskLoop product is hosted, how data is encrypted in transit and at rest, how backups are run, retention periods and single sign-on support will be published here.
If you need this information before choosing TaskLoop, ask during your demo or contact the team. We will answer your questions directly.
Responsible disclosure
If you believe you have found a security vulnerability in the TaskLoop website or product, please report it to dev@rozamoon.com.
Please include:
- a description of the issue and its possible impact
- the affected URL, app or component
- steps to reproduce it
We ask that you:
- give us reasonable time to investigate and fix the issue before disclosing it publicly
- do not access, change or delete data that is not yours
- do not run tests that degrade the service for others, such as denial-of-service or high-volume automated scanning
- do not use social engineering or physical attacks
We will acknowledge your report, keep you updated while we investigate, and credit you if you wish once the issue is fixed.
Questions people ask
Where is TaskLoop customer data hosted?
Details on hosting location, encryption, backups and access controls for the TaskLoop product are being documented and will be published on this page. Until then, ask during your demo or email dev@rozamoon.com, and the team will answer your security questionnaire directly before you make any decision.
Does TaskLoop support single sign-on?
Single sign-on is not something we state as available on this page yet. If SSO is a requirement for your organisation, mention it when you book a demo or contact the team, and we will tell you plainly what is supported today before you commit to anything.
How do I report a security vulnerability?
Email dev@rozamoon.com with a description of the issue, the affected URL or component, and steps to reproduce it. Please give us reasonable time to fix the issue before sharing it publicly, and do not access, change or delete data that does not belong to you while testing.