Security
How Cashew.Tools keeps a team's tasks, and the assistants acting on them, under control.
Placeholder text
Access for assistants
Assistants connect through OAuth 2.1 grants, not API keys. A grant names the client, the scopes, the spaces it may see, and an expiry, ninety days by default. It can be revoked in one click and there is nothing to rotate afterwards.
- Deletes are recoverable. A deleted task, comment, or attachment can be restored for thirty days before it is removed for good.
- Reorganizing the workspace and changing who can see a space are separate permissions, granted one at a time.
- Bulk operations are capped at fifty items per call.
- Every write carries an actor: the person, the assistant acting for them, the client, and the grant.
Access for people
Sign in uses passkeys first, with an emailed link as the fallback. There are no passwords to leak.
Data isolation
Every table is protected by row level security per organisation in PostgreSQL. Humans and assistants share one mutation path, so the audit trail is complete by construction.
Infrastructure
The service runs on Amazon Web Services in us-east-1 behind Cloudflare. Attachments live in a private S3 bucket and are served through short lived signed URLs.
Reporting a vulnerability
A disclosure address and response commitments will be published here before launch.