Your work is safe here
What we do today to protect your data — in plain language, with no badges we haven't earned.
Encryption
All traffic is encrypted in transit (TLS), and your data is encrypted at rest — on every plan, not just paid ones.
Sign-in & access
Authentication is handled by Clerk. On the web you may sign in with Google, Apple, email code, password, or a passkey. In the iOS and Android apps you may sign in with Apple, Google, email code, or password (not passkeys). dotby never sees or stores your password.
Inside a workspace, access is controlled with admin, manager, member, and guest roles, so people only see what their role allows.
Workspace isolation
dotby is multi-tenant with per-workspace isolation: every query is scoped to your workspace, so one customer's data is never visible to another.
Infrastructure
dotby runs on a small set of trusted providers:
- Convex — database & real-time backend
- Cloudflare — website hosting, CDN, and file storage (attachments)
- Clerk — identity & sign-in (Apple, Google, email, password; passkeys on the web)
- Stripe — Pro checkout on the web only (no in-app purchases on iOS or Android)
- Resend — transactional email
- Slack — optional web integration, when a workspace admin connects it
Your data stays yours
Export your data anytime and delete your workspace whenever you want. You can also delete your personal account from Profile in the web app and in the iOS and Android apps. Access, export, and deletion requests are honored under LGPD, GDPR, and applicable US state laws — see the Privacy policy for the full detail. No lock-in.
Where we are today
We do not claim SOC 2 or similar certifications we have not earned. The iOS and Android apps do not include advertising or analytics SDKs, push-notification tokens, or in-product AI. Security questions or reports: hello@dotby.app.