Security & Privacy

How we protect your data

Your projects, tasks and client details are yours. Here's how Ctrldesk keeps them safe, who can see them, and the controls you have. The full detail lives in our Privacy Policy.

Encrypted

Encrypted in transit (TLS/HTTPS) and at rest by our hosting providers — on the wire and on disk.

Isolated by the database

Row-level security scopes every record to your account and organisation. One user cannot read another's projects or clients — enforced at the database, not just the screen.

Yours to export

One click in Settings → Your data & privacy gives you a complete, portable JSON copy of everything, any time.

Yours to delete

Delete your account and all its data yourself, whenever you want — no email, no waiting.

Where your data lives

Ctrldesk runs on managed, industry-standard infrastructure: a Supabase (PostgreSQL) database for your data and sign-in, and Vercel for hosting the app. Both encrypt data in transit and at rest. Secrets that could read across accounts (the database's privileged key) are never shipped to your browser or stored in our code.

Who can see your data

You — your own projects, tasks, designs and settings.
Your team — only where you use organisations and only for content that's been created in, or explicitly shared into, that team. Access levels (owner / admin / editor / viewer) are enforced in the database.
Nobody else. Another user cannot read your data, and the anonymous app key physically cannot reach other people's records or the account/email table.

The controls you have

Export — a full JSON backup, any time (Settings → Your data & privacy, or the ↓ in the sidebar).
Delete — permanently erase your account and data yourself. Shared team content that others rely on stays with the team.
Offline copy — the app also keeps a copy in your browser so it works offline; you can clear it any time, and it's only readable by someone with access to that device.

Analytics — privacy-first

Our website analytics are cookieless and store no personal data and no IP addresses — just coarse, anonymous visit counts. They respect your browser's Do-Not-Track setting. There is no advertising or cross-site tracking.

The standards we build to

Ctrldesk is built to follow the principles of the EU/Dutch GDPR (AVG) — data minimisation, encryption, least-privilege access, and giving you real control (export & erase). These practices also map to the core controls of security frameworks like ISO/IEC 27001.

Honest note: we follow these principles today; we are not yet formally certified against ISO 27001 or SOC 2 (a paid external audit we may pursue as we grow). We'd rather tell you exactly what we do than claim a badge we haven't earned.

Report a concern

Found something that doesn't look right? Contact us via the contact form or at info@ctrldesk.co. To exercise a data right, use privacy@ctrldesk.co. You can also read the full Privacy Policy and Terms.

Read the full Privacy Policy →