Security Policy
How we protect your account, your data and your payments.
1. Account security
- Passwords are never stored in readable form. They are hashed with bcrypt, a slow one-way algorithm, so nobody at TaskHub AI can read your password.
- Sessions use signed, HTTP-only cookies that JavaScript in the browser cannot read.
- Every page and API endpoint that handles personal data checks your session on the server, and the account is derived from that session, never from a value sent by the browser.
- Access is role based: customers, providers and administrators each see only what their role permits.
2. Data in transit and at rest
All traffic between your device and the platform is encrypted with HTTPS/TLS. The database is hosted in a managed environment with encryption at rest, restricted network access and automated backups. Files you upload in the chat are stored in private cloud storage, in a folder scoped to your account, and are served only through signed links that expire.
3. Payment security
Card data is captured and processed by a PCI-DSS compliant payment processor. Full card numbers and bank credentials never touch TaskHub AI servers and are never visible to providers or administrators. Because payments are intermediated, providers never see your card details and you never need to hand cash to a stranger.
4. Application hardening
- Database access uses a query layer that parameterizes every value, which prevents SQL injection.
- Responses carry security headers, including a strict content-type policy, a restrictive referrer policy and a permissions policy that limits camera, microphone, location and payment access.
- Camera and location are only requested when you actively use a feature that needs them, and only over a secure connection.
- Uploads are validated for type and size, and the stored file extension is derived from the real content, not from the name the browser sent.
- Chat attachments can only be attached to a conversation by the account that uploaded them.
5. What we ask of you
- Use a unique password of at least 8 characters that you do not use anywhere else.
- Never share your password. TaskHub AI staff will never ask for it.
- Keep all conversation and payment inside the platform. Anyone asking you to pay by wire transfer, gift card, payment app or cash is breaking our rules and should be reported.
- Do not send identification numbers, full card numbers or passwords through the chat.
- Sign out on shared devices.
- Verify the identity of anyone arriving at your home, and check the business name matches the booking.
6. Reporting a vulnerability or incident
If you believe you have found a security vulnerability, or that your account has been accessed without permission, contact us immediately through the Contact page with the details and the time it happened. Please do not test vulnerabilities against other users’ data. If a breach affects your personal information, we will notify you and the relevant authorities as required by law.
Template for review, not legal advice
This document was prepared as a working template for a US marketplace with intermediated payments. The percentages, time windows and tax statements are configurable defaults and must be reviewed by a licensed attorney in your state before the platform processes real payments.