Security at every layer.
Your data is protected by row-level security, encryption, and role-based access control — from database to browser.
Security highlights
Encryption
TLS 1.3 on every connection, with HSTS enforced. The database is never exposed to the internet.
Row-level security
Every database table has RLS policies. Users can only access data they are authorized to see.
RBAC
Role-based access at both project and organization levels. Permissions enforced server-side.
CSP headers
Content Security Policy with strict-dynamic script-src. Nonce-based script allowlisting prevents XSS.
Infrastructure
RRSTT runs on a dedicated server operated by OVHcloud in Beauharnois, Quebec, Canada. Your data is stored in Canada. We run the open-source Supabase stack ourselves on that server for the database, authentication, file storage and realtime updates, so no third-party database host holds your data.
The application is a Next.js app deployed with Coolify. All traffic reaches it over HTTPS with TLS 1.3. PostgreSQL is not reachable from the internet: the app and the desktop client reach data through the authenticated Supabase API over HTTPS, never through a public database port.
Authentication
Authentication is handled through Supabase Auth with cookie-based sessions and PKCE flow for email confirmation and password reset. Session tokens are stored in HTTP-only, secure, same-site cookies. JWT claims are validated locally at the edge middleware layer before any page renders.
Password hashing uses bcrypt. Email verification is required for new accounts. Password reset tokens are single-use and time-limited.
Data Isolation
Organization data is fully isolated through PostgreSQL row-level security policies. Each RLS policy verifies the requesting user's membership and role before granting access. Organization-scoped queries include org_id filtering at the database level — not just the application level.
Project-level isolation adds another layer: private projects are only visible to explicitly invited members, regardless of organization role. Even organization owners must be invited to view private project content.
Role-Based Access Control
RRSTT implements two-tier RBAC:
- Organization roles (owner, admin, member, guest) control org-level actions like billing, member management, and settings.
- Project roles (owner, co-owner, collaborator, viewer) control project-level actions like task creation, time editing, and file management.
Organization roles and project roles are independent. An org admin manages users and billing but does not automatically have access to project content. This follows the autonomy model used by tools like Asana and Notion.
Audit Logging
Organization-level actions are recorded in an audit log, including member additions/removals, role changes, settings updates, and data exports. Time entry modifications are recorded in a separate session audit log with before/after values. Audit logs are retained for the lifetime of the organization.
Responsible Disclosure
If you discover a security vulnerability in RRSTT, please report it to security@rrstt.app. We will acknowledge receipt within 48 hours and provide a timeline for resolution. We ask that you do not publicly disclose the vulnerability until we have had a reasonable opportunity to address it.
Keep your team's projects
moving forward.
RRSTT gives your team one focused place to manage tasks, track time, and stay on the same page. Join the waitlist to get early access.