Trust

Security

Security is foundational to GetItDone. This page describes the controls we have in place to protect your data.

Encryption

• In transit. All traffic to GetItDone is encrypted with TLS 1.2+.
• At rest. Database backups and file storage are encrypted at rest.
• Passwords. Stored using bcrypt with a per-user salt.

Access control

• Role-based permissions (Owner, Admin, Member, Viewer) at the workspace level.
• Granular per-space and per-list permissions for sensitive content.
• Session expiry and forced re-authentication for sensitive actions.

Infrastructure

• Hosted on hardened servers in Kenya with daily off-site backups.
• Webhook signatures (HMAC-SHA512) verify all inbound payment events.
• CSRF tokens protect every state-changing request.

Reporting a vulnerability

If you discover a security issue, please email getitdone@getitdone.pinch.africa with the subject "Security Report". Please do not publicly disclose the issue before we have had a reasonable opportunity to investigate and remediate.

Compliance

We follow the Kenya Data Protection Act, 2019 and align with GDPR principles. See our privacy policy for details.