Security at TaskPilot
TaskPilot runs on webpages you already trust with sensitive work. Here’s how we keep that trust.
No API keys in your browser
Every AI request routes through our server-side proxy. Provider keys live only on the server and are never shipped to the extension or exposed to page scripts.
Least-privilege permissions
The extension requests only what it needs — active tab and storage. Broad host access is optional and off by default. No browsing history, no background tab access.
Isolation on the page
Our on-page UI renders inside a closed Shadow DOM, so it can’t be read or tampered with by the sites you visit, and it won’t collide with their styles.
Row-level security
Every user table in our database enforces row-level security, so one account can never read or modify another account’s rows — enforced at the database, not just the app.
Rate limiting & abuse prevention
Per-identifier sliding-window rate limits and burst detection protect the Service and your account from abuse and runaway costs.
Encryption in transit
All traffic between the extension, our servers, and our processors is encrypted with TLS. Sessions use short-lived, ephemeral tokens.
Data-handling practices
- ✓Page content is processed in real time and not retained after your request completes.
- ✓Local-first parsing: regex and heuristics run in your browser, so much of your data never leaves your device.
- ✓Payments are handled by Stripe; we never receive or store full card numbers.
- ✓Least-data collection: anonymous sessions let you use core features without an account.
- ✓Full data deletion on request, with EU data-residency available for enterprise.
Reporting a vulnerability
If you believe you've found a security issue, we want to hear from you. Email security@taskpilot.cc with details and steps to reproduce. Please give us a reasonable window to investigate and fix before public disclosure. We don't take legal action against good-faith research that respects our users' privacy and data.
Enterprise customers can request our security documentation, subprocessor list, and data-processing agreement at security@taskpilot.cc.