Data and security
Ce contenu n’est pas encore disponible dans votre langue.
The short version: your data stays in your workspace, deletion is reversible, and nothing in dotby is designed to make leaving hard.
For the formal statements, see the security page and the privacy policy.
Signing in
Section titled “Signing in”Three ways, all first-class:
- Magic link — a one-time link to your email
- Passkey — Face ID, Touch ID, or a hardware key
There is no password to leak, reuse, or rotate.
Some actions — changing the email on your account, for instance — ask you to re-verify even though you are already signed in. That is deliberate: a stolen open session should not be enough to take an account over.
Tenant isolation
Section titled “Tenant isolation”A workspace is the boundary. Data never crosses between workspaces, even when the same person belongs to several.
An API key or an MCP connection is workspace-scoped and carries its owner’s own permissions. There are no super-tokens. See API keys and tokens.
What a private project means
Section titled “What a private project means”A private project is invisible to everyone who was not explicitly added — including admins. An admin can add themselves, and that action is written to the audit log.
This matters for HR, legal, and compensation work, where “the admin can see everything” is not an acceptable answer.
Attachments are stored against your workspace and served through short-lived, signed links. A link that leaks does not stay useful.
Office documents — Word, Excel, PowerPoint — are previewed inside your workspace. The file is not shipped to a third-party viewer to be converted. See Files and attachments.
Money is never sent to the browser it should not reach
Section titled “Money is never sent to the browser it should not reach”When pay visibility is off for a workspace or a person, the amounts are not hidden with CSS — they are never included in the response. There is no hidden element to inspect, and no API shape that returns them to an unauthorized client.
The audit log
Section titled “The audit log”Who did what, when. Role changes, permission grants, deletions, plan changes, private-project access.
Reading it requires an admin, or a manager holding audit.view. The grant of
audit.view itself appears in the log.
Deletion, and getting it back
Section titled “Deletion, and getting it back”| Deleted | Recoverable for |
|---|---|
| A task | Archive — indefinitely, one click to restore |
| A project | 7 days in the Trash |
| A workspace | 30 days, with billing paused meanwhile |
Nothing is destroyed on the way to the trash, and restoring a project restores its history with it.
Getting your data out
Section titled “Getting your data out”Two routes, both available to you without asking anyone:
- The REST API — every task, project, page, sprint, and initiative, with cursor pagination. See Build your first integration.
- The CLI — the same thing shell-shaped, with
--json. See Use the CLI.
Both are Pro features. If you are on Free and need an export, contact hello@dotby.app.
Reporting a security issue
Section titled “Reporting a security issue”Email hello@dotby.app. Tell us what you found and how to reproduce it. Please do not test against a workspace that is not yours.
- Security — the formal posture.
- Privacy — what we store and why.
- Roles and permissions — the access model.