Security & compliance

How we protect your data.

Daymuster holds your agency's client list, task history, time logs, and encrypted client credentials. Treating that with anything less than full seriousness wouldn't be a product - it'd be a liability. Here's the candid version of how we do it.

Encryption

At rest

AES-256-GCM with key versioning for every credential vault entry. Encryption keys live in environment variables managed by Vercel (not in the database). Key rotation supported via the CREDENTIAL_ENC_KEYS_OLD fallback list, re-encrypts run via the rotate-credential-key script. Rest of the database is encrypted at rest by Neon (AES-256, AWS KMS-backed).

In transit

TLS 1.2+ end-to-end. The custom domain serves a fresh Let's Encrypt certificate that auto-rotates every 90 days. HSTS enabled. Vercel terminates TLS at the edge; function-to-database hops stay inside AWS us-east-2 (Ohio).

Authentication & access

Password auth

bcrypt (10-round) hashing. No password ever stored in plaintext or logged. Reset tokens are SHA-256 hashed before storage and expire after 1 hour.

Two-factor (super-admin)

Required for super-admin and operator-console access (TOTP via authenticator apps). Workspace-wide MFA enforcement for regular admins is on the roadmap and not yet available.

Tenant isolation

Every Prisma query in the codebase is scoped by organizationId, and every request resolves the workspace from the session rather than from anything the browser sends. Isolation tests run against a database, not in the standard CI pass.

Infrastructure

Hosting

Vercel (functions in us-east-2 / Ohio, AWS-backed). Neon for Postgres (also us-east-2, point-in-time recovery + encrypted backups). Vercel Blob for user-uploaded files (logos, task attachments).

Backups

Neon keeps a change history for point-in-time restore. We are on Neon's Free plan, whose restore window is 6 hours, so the nightly dump we take ourselves is the longer-dated copy. Those go to a private Backblaze B2 bucket in the United States, encrypted at rest, and are deleted after 30 days by a lifecycle rule on the bucket. Self-service workspace export is available via Settings → Advanced → Data export.

Logging & monitoring

Function logs retained 24 hours (Vercel free) / 30 days (enterprise). The audit log of every operator action, and the credential-reveal trail, are kept for one year.

Sub-processors

Daymuster runs on third-party infrastructure. The companies listed here process your data on our behalf. If we add a new sub-processor or change a category, we'll update this page first, and notify workspace admins by email for enterprise customers.

Vercel

Application hosting, serverless functions, blob storage

USA (us-east-2)

Neon

Postgres database hosting

USA (us-east-2)

Anthropic

AI features (Claude): meeting notes to tasks, client profiles, drafts and summaries

USA

Resend

Transactional email (invites, password resets, digests)

USA

PayPal

Subscription billing

USA / Global

Google

USA

Sentry

Error monitoring for the application

USA

Crisp

Live chat on the public website

EU (France)

Backblaze

Encrypted off-site storage of database backups

USA

GitHub

Source hosting, and the scheduled job that takes nightly backups

USA

Compliance & attestations

SOC 2 Type II, in progress

Daymuster is a young product. We have not yet completed a SOC 2 Type II audit. We are working with an auditor and expect the Type I report in Q4 2026, Type II in Q2 2027. We will not claim what we don't have.

In the meantime: customers under contract receive a security questionnaire response (SIG-Lite, CAIQ-Lite) and our Data Processing Agreement. Email security@theauctores.com for either.

GDPR

Data Processing Agreement available on request. Right-to-delete: workspace admin can delete their org from Settings → Advanced (30-day grace + permanent purge by cron). Right-to-access: full CSV export of tasks, time entries, clients, credentials metadata, activity and invoices, from Settings → Advanced export. Sub-processors listed above.

HIPAA / PCI

Daymuster is not HIPAA-compliant and is not PCI-DSS-attested. Don't store PHI in task details. Don't paste credit card numbers into credential vault. Card payments go through PayPal or the payment link you add to an invoice; card details never touch Daymuster servers.

Incident response

Reporting a vulnerability

If you've found a security issue, email security@theauctores.com with reproduction steps. We acknowledge within 24 hours, triage within 72, and aim to ship a fix within 14 days for high-severity issues. We don't currently run a paid bug bounty but credit researchers in release notes on request.

Customer notification

In the event of a confirmed data breach affecting your workspace, we notify the workspace admin by email within 72 hours of confirmation, with: what happened, what data was involved, what we've done, and what you should do. This obligation is also in the Data Processing Agreement.