Overview

‍

Security is a foundational aspect of TaskForge's architecture. This guide covers the security controls, data privacy policies, and compliance features available to all workspace administrators and developers. Whether you are building internal tooling or processing customer data, TaskForge provides the infrastructure to meet your security requirements.

‍

‍

Data encryption

‍

All data processed and stored by TaskForge is encrypted at rest using AES-256 and in transit using TLS 1.3. This applies to pipeline configurations, task payloads, model weights, logs, and all other workspace data.

‍

Encryption keys are managed per-workspace using a BYOK (Bring Your Own Key) model for enterprise plans. Standard plans use TaskForge-managed keys rotated automatically every 90 days.

‍

‍

Access control & permissions

‍

TaskForge uses a role-based access control (RBAC) system to govern what each workspace member can see and do. The default roles are:

‍

• Owner: Full access to all workspace resources, billing, and member management.
• Admin: Full access to resources except billing settings.
• Developer: Can create, edit, and deploy pipelines and models. Cannot manage members.
• Viewer: Read-only access to pipelines, analytics, and logs.

‍

Custom roles can be created on Enterprise plans, allowing granular permission assignment at the resource level.

‍

‍

Network security

‍

For production workloads handling sensitive data, TaskForge supports:

‍

• IP allowlisting: Restrict API access to a list of approved IP addresses or CIDR ranges.
• VPC peering: Connect your TaskForge workspace directly to your private cloud network, bypassing the public internet entirely.
• Private endpoints: Available on Enterprise plans for dedicated, isolated infrastructure.

‍

To configure IP allowlisting, go to Settings → Security → Network Restrictions.

‍

‍

Audit logs

‍

Every action performed in your TaskForge workspace is recorded in the audit log, including:

‍

• Member sign-ins and sign-outs
• Resource creation, modification, and deletion
• Permission and role changes
• API key generation and revocation
• Pipeline deployments and rollbacks

‍

Audit logs are retained for 90 days on standard plans and up to 2 years on Enterprise plans. They can be exported in JSON or CSV format and streamed to an external SIEM using the webhook integration.

‍

‍

Data privacy & compliance

‍

TaskForge is designed to support compliance with major data privacy frameworks including GDPR, CCPA, and SOC 2 Type II. Key privacy features include:

‍

• Data residency: Choose the geographic region where your workspace data is stored (US, EU, APAC).
• Data retention policies: Configure automatic deletion of logs, task payloads, and model outputs after a defined period.
• Right to erasure: Submit a data deletion request through the workspace settings to permanently remove all data associated with a user or dataset.

‍

‍

Vulnerability disclosure

‍

TaskForge operates a responsible disclosure program for security researchers. If you discover a vulnerability, please report it to security@taskforge.io with a detailed description of the issue, steps to reproduce, and potential impact. We aim to acknowledge all reports within 48 hours and provide a resolution timeline within 7 days for critical issues.