Skip to content
Toado Docs

Security

This page is the public-facing summary. The full security policy lives at toado.dev/security. For incident reports or coordinated disclosure, see Contact.

In transit

  • All traffic between clients (web app, extension, MCP server) and the Toado backend is HTTPS only. HTTP is not supported.
  • TLS 1.2 minimum, TLS 1.3 preferred. Modern cipher suites only.
  • Certificate management is handled by Vercel’s edge.

At rest

  • Postgres for all relational data, encrypted at rest by the managed provider.
  • Captured screenshots and attachments live in object storage (S3-compatible, encrypted at rest).
  • API tokens are hashed; the plaintext is shown once at creation and is not recoverable.
  • Passwords: there are no Toado passwords. Sign-in is OAuth (Google) or email magic links. There is nothing for an attacker to brute-force.

Auth

  • Web app sessions: short-lived cookies, refreshed against the auth provider on idle.
  • Extension auth: OAuth handoff to the web app, returns a session bound to the extension’s local storage.
  • MCP and REST: Bearer tokens in the Authorization header. See API tokens.
  • All write operations record the calling identity (user id, token id, token label) on the resulting row.

Multi-tenant isolation

  • Every row in every table is scoped to a company id.
  • Queries are filtered server-side by the calling user’s company memberships; there is no shared “all companies” view.
  • Tokens can be restricted further (to specific companies or projects); restricted tokens never see rows outside their scope, including in search.
  • Cross-company moves of tickets are forbidden in the API regardless of token scope.

Trust boundary, in plain English

What you trust Toado with when you capture a page:

  • The screenshot pixels.
  • The console output the page produced since extension load.
  • The network requests the page made since extension load: method, URL, status, headers, timing and size. Request and response bodies are included only when Deep network capture for this site is on for that site, and then up to a size cap, including any sensitive data those bodies contain.
  • The URL.

Standard extension page captures do not read browser cookie jars, local storage, or IndexedDB as separate datasets. Sensitive information can still appear in screenshot pixels, page URLs, console messages, or network evidence. Form fields visible on screen can appear in screenshots; do not assume that what you type is excluded from every kind of evidence.

A screen walkthrough records the source you choose in the browser’s sharing prompt, which can include more than the page you started from. Narration adds microphone audio. Check the selected source and avoid displaying or saying information that must not be uploaded.

See Permissions & privacy for the extension’s specific permission usage.

Bug report widget security

Project widget keys are public identifiers intended to appear in site source; they are not account credentials. Owners restrict them with allowed-site rules and can disable a widget or rotate its key. Rotation invalidates the old key immediately.

Anonymous reports use origin validation, CAPTCHA where applicable, and server-side rate limits. Toado filters known sensitive payload values in the browser, masks form fields in DOM-rendered screenshots, and excludes the widget UI and its own config/submission traffic from evidence. Deep capture instruments networking APIs and can conflict with bot-protection systems, so it is opt-in and must be tested.

Owners remain responsible for where they install the widget, the questions and capture depth they configure, and any notice or consent their reporters require. See Widget security.

Redaction

The annotation toolbar’s redact and blur tools mask the rendered image. The raw screenshot bytes still exist on the server.

There is no capture-time image redaction. The extension’s pre-upload redaction covers network headers, bodies and URL parameters (see Extension options › Redaction), not screenshot pixels.

For sensitive content you must not have on the server: do not capture the page.

Walkthrough recording

A walkthrough records your microphone and, in screen mode, the sharing source you choose. The web recorder can share a tab, window, or entire screen; narration-only mode omits the screen video. Transcription can turn what you said into text. Four things bound that:

  • Speech is redacted before it is stored. The transcript passes through Toado’s shared redaction rules before it is written, so recognisable tokens, keys and similar secrets are masked in the stored text and in the description written from it. Ordinary spoken secrets and the audio itself are not redacted; the recording window says so before you start.
  • Screen recording is an optional permission. The extension does not hold desktopCapture at install. It is requested from your click on Choose what to record the first time you record, and only when the walkthrough will record the screen. In that extension flow, Chrome’s picker offers a window or a Chrome tab rather than an entire screen, and system audio is not offered. The separate web-app recorder can offer an entire screen; inspect the selected source before sharing.
  • The microphone is handled by the recording start window. That window asks Chrome for microphone access in order to list your inputs, lets you pick and test one, and passes the chosen device to the recorder. Test audio is never saved or uploaded. Only the registered recording window can start or stop a recording, and a stale or duplicate window cannot impersonate it.
  • Audio reaches the transcription provider before text redaction. Where transcription is enabled and requested, audio is sent to OpenAI before stored transcript text is redacted. Audio itself is not automatically redacted. Transcription is disclosed in the privacy policy. How narration is transcribed, and by whom, is set out at toado.dev/privacy. That page is canonical.

See Walkthrough recording and Walkthrough media retention.

Logging and audit

  • Every API call is logged with the calling token id, IP, user agent, and operation.
  • Write operations additionally record the resulting state diff for tickets and comments.
  • Logs are retained per the data retention policy.
  • Owners can export the audit log as CSV from Settings › Audit log. See Audit log › Export.

Incident reporting

If you believe you have found a security issue:

  1. Email security@toado.dev with a description, reproduction steps, and (optionally) a suggested fix.
  2. We will respond within 48 hours.
  3. We do not run a paid bug-bounty program in v1; we will publicly credit reporters who request it.

Please do not file public GitHub issues or social-media posts before contacting us.

Compliance

Toado is in early-stage growth. We do not currently hold SOC 2, ISO 27001, or HIPAA certifications. The roadmap includes SOC 2 Type II once we have customer pull for it.

For DPA, see toado.dev/dpa.

Source availability

The MCP server is open source under the MIT licence at github.com/toado-dev/toado-mcp. The hosted endpoint runs that code, so you can read exactly what sits between your client and the API, and run it yourself (see Source and self-hosting). The Chrome extension, the web app and the backend remain closed source. Publishing the server does not widen what it can reach: it holds no credentials of its own, forwards the caller’s bearer per request, and every scope check it performs is repeated by the API.

Where to next