Built for your security review

Encryption and transport

• TLS on every hostname, with certificates issued and renewed automatically.
• MES database credentials and authenticator secrets are encrypted at rest.

Identity and access

• Single sign-on through OpenID Connect, configured per company.
• Passwords hashed with bcrypt. Sign-ins are throttled, with lockout after repeated failures.
• Sessions are server-side and can be revoked.
• An authenticator app (TOTP) is required for administrators and for anyone who signs records.
• Each company’s data is separated by company and site scope on every request, and branches see only their own projects, templates and quality records.
• Permissions are set per company, region and branch. Publishing templates, reviewing templates and signing records are separate permissions, granted separately from admin rights.

Electronic signatures

• Signing re-asks for the password and a current authenticator code. Each code works once only.
• Each signature records the signer, the time, its meaning (for example reviewed, approved, rejected) and a hash of the signed content. Verification reports if the content changed after signing.
• Repeated failed signing attempts lock signing for 15 minutes, and every refusal is recorded.
• Used for template review and approval, phase gate decisions, project sign-off and corrective action closes.

Audit trail

• Every write records who, what, when, from where, and the outcome.
• Events are hash-chained and append-only, so the chain can be verified and any gap or edit shows up.
• Company administrators can read their own trail, verify the chain, and export it as CSV or JSON.
• The trail can be forwarded to your SIEM over HTTP or syslog.

Backups and recovery

• Nightly backups, plus a backup before every upgrade. Retention is set per client.
• Backups can be copied off the server to object storage or another host.
• Restore drills restore a backup into a scratch database and compare it, table by table, with the live one. Recovery is tested, not assumed.

Upgrades

• Upgrades roll out in waves: demo, then canary clients, then everyone.
• Every stack is backed up first.
• The first stack that fails its health check is rolled back automatically, and the rollout stops.

Application security

• The application is served with a strict Content Security Policy.
• Fonts, styles and scripts are part of the product rather than loaded from public CDNs, and pages carry no inline event handlers.
• Secrets never live in the source tree; a scan runs before every commit.
• This website follows the same rules: every file is served from this domain.

MES access

• TaskOptic only reads from your MES. It sends no commands and changes nothing there, and automated tests check that every MES call is a read.
• Connect through read-only SQL views your IT team creates on the MES database (the TaskOptic view contract, on PostgreSQL or SQL Server), with an account that can read those views and nothing else. Or the MES offers the TaskOptic MES Connector API, a read-only REST standard, or a supported MES product connects through its own API. Every one is read-only.
• MES passwords, client secrets and API keys are encrypted at rest and never shown again after saving.
• Every connection is checked before it is made: cloud metadata and link-local addresses are always refused, and internal network addresses only work where they are allowed for your site. Calls time out and responses are size-limited.

API and connected apps

• API clients are created by company administrators, with only the scopes they need and, if you choose, only certain sites. Keys are shown once, stored as a hash, and can be rotated or revoked at any time.
• API clients can never sign records, approve templates, decide gates or call the AI features. Those stay with people.
• Every API call is subject to the same company and site checks as the app, is rate-limited, and every write is recorded in your audit trail under the client’s name.
• Webhooks are signed (HMAC-SHA256 with a timestamp) and are only sent to addresses allowed for your site.
• AI tools such as Claude connect through OAuth 2.1 with PKCE. The person signs in and approves on a consent page, the tool sees only what that person can see, and each connected app can be disconnected from the Security page.

AI and your data

• AI assistants work only when a person asks: drafting templates, corrective action sections, MES route versions and answers about a project.
• The AI only proposes. A person applies each change, and nothing is signed or published by the AI.
• Requests go to the AI provider configured for your instance or chosen by your company, and every request is recorded in your audit trail.
• Attached documents, scans and photos are sent to the AI only when a company administrator allows it. Run results are sent only as counts and numbers, with no names, customers or free text.
• TaskOptic does not train AI models, and your data is not used to train them.
• Like every module, the AI features can be switched off for your company.

Send us your questionnaire

Send your security questionnaire or review checklist to hello@taskoptic.com.