Security and privacy
Serious safeguards for your data
Client, project and gear data is sensitive, so here is exactly how we protect it: what runs today, what's planned, and how to reach us about a security issue.
Core controls
Encryption in transit and at rest
All traffic between your browser and the app is encrypted with TLS (HTTPS); data at rest in the database and file storage is AES-256 encrypted. Sensitive fields such as ID and passport numbers are additionally encrypted at column level.
Row-level security
Row-level security in the database limits every query to the rows the signed-in user is authorized for, so no workspace can see another workspace's data.
Hosted in the EU
The database runs in Supabase Frankfurt (eu-central-1) and files are stored in Cloudflare R2's EU jurisdiction. The full list of service providers (video streaming, email, calendar and maps) and any transfers outside the EU are in our Privacy Policy.
Automatic backups
The database is backed up automatically every day, and the last 7 days of backups are retained.
Two-step verification and session security
Every user can turn on two-step verification with an authenticator app (TOTP). Once it's on, your data can't be reached at the database level until the second step is complete. You can sign out of all your other devices at once, and irreversible actions such as deleting an account ask for an extra confirmation.
Role-based access
Owner, Admin, Moderator, Member, Contractor, Freelancer, Agency, Client and Client lead roles come built in; on Business Growth and up you can define your own. The access review screen shows what a person can actually see and do, and role changes are recorded in the activity log.
Your rights and our processes
Your rights under KVKK and GDPR
Our processing purposes are set out in the disclosure notice; on every plan you can delete your account and download your data yourself.
- Account deletion: Settings › Danger Zone › Delete Account
- Data portability: download your personal data as JSON from Settings › Danger Zone › Download My Data
- Access and correction requests: [email protected], answered within 30 days at the latest
Vulnerability disclosure
We follow responsible disclosure. If you believe you have found a security vulnerability, report it to us and we'll get back to you as soon as we can.
- [email protected], subject line: Security report
Incident response
If a breach affects personal data, we notify the Turkish Personal Data Protection Board within 72 hours and affected people without undue delay, and share in writing what happened, its impact and what we did.
Roadmap
Public status page
status.letstodomore.com
Independent penetration test
A third-party test is planned; the summary will be shared on this page.
This page is reviewed and updated regularly.
Report a security issue
Write to us under responsible disclosure; we'll get back to you as soon as we can.
[email protected]