Security by restraint.

OkTrack is built around least-privilege connections, explicit confirmation, encrypted credentials, and workspace-scoped access.

Read-only activity sources

Commit and calendar sources are imported for review. Calendar integrations do not write changes back to source events.

Protected credentials

OAuth access and refresh tokens for sources and delivery destinations are encrypted with versioned application keys. Secrets, authorization headers, and message bodies are redacted from application logs and external telemetry.

Verified boundaries

Protected sessions verify identity, signed events update subscription state, and every data request is scoped to workspace membership.

Operational controls

Generation and delivery jobs use idempotency keys, retries use backoff, provider failures remain visible, and each delivery stores the minimum remote identifier needed to prevent an accidental duplicate. A test delivery contains no work content.

Controlled delivery

A daily update is sent only to a destination selected for that member and workspace. The first release requires explicit approval. Private source details are minimized before an update is prepared, and a workspace or destination access check runs again immediately before delivery. Suspending a member, pausing a destination, disconnecting an account, or revoking provider consent stops queued delivery.

Data lifecycle and response

Raw provider responses and secrets are not retained. Expired operational records are cleaned automatically, account deletion coordinates provider, billing, identity, and database erasure, and a deletion that cannot complete in time is surfaced rather than silently dropped. Security and privacy incidents follow a timed containment, assessment, notification, recovery, and post-incident process.

Reporting a vulnerability

Send a concise report to support@oktrack.app. Include the affected URL or feature, impact, reproducible steps, and safe evidence. Do not access other users' data, disrupt production, use social engineering, or include credentials, raw tokens, private calendar content, or unredacted account downloads. OkTrack will acknowledge reports, prioritize containment by severity, and provide status updates when contact information is available.