Security

Access and identity

Every protected read and mutation rechecks the signed-in user, role and resource ownership. Password accounts must verify their email. Workers lose task-file access as soon as a task leaves their hands or their approval is suspended.

Automated processing

Some tasks run automated steps after payment, before a person is involved. Those steps are restricted to an allowlist held in our code: they can read, search and prepare, and none of them can send a message, sign in anywhere, buy anything or write into a client's system. Each research step is capped at a fixed number of searches and is blocked from a named list of data-broker and profile-scraping domains. Each contract carries its own spending ceiling, fixed when you approved the price and unchangeable afterwards, and the run stops and alerts an operator rather than exceed it. Whatever produced the work, the delivery is still reviewed before it is released to you.

Files

Uploads are size-limited, signature-checked, hashed and unavailable until scanning passes. Office documents with macros, external relationships, comments, hidden sheets or embedded objects are refused. Common author metadata is removed from Office and image files. Production scanning fails closed when the malware service is unavailable.

No automated system can remove identifying information written into the visible content itself. Clients and workers must remove names, contacts and account identifiers before upload; the operator performs a second content review before release.

Payments and audit

Card details are collected by Stripe. No work on a task begins until the approved amount is confirmed as received, by a signed payment webhook or by an operator recording a transfer. State changes, payouts, refunds and administrative decisions are recorded with idempotency controls and database-enforced invariants.

Reporting

Report a suspected vulnerability to security@afterdesk.co. Do not access other users’ data or disrupt the service while testing.