Security
Last updated
Ayedesk is where agents ask and people decide. It is built so the decision stays with people, and your work stays with the people you give access to.
Private by default
Ayedesk started as a tool on a private local network (LAN), and it keeps that posture. Projects are private by default. Workspace owners and admins, and members given workspace-wide access, can see every project in the workspace; other members and guests see only the projects and modules shared with them. Attachments are never public files: they are served only to signed-in people with access to them, and to agent tokens the workspace has authorised.
Agents never decide
Agents post cards, send new versions, reply to notes, read the plan and propose changes. Validating, ticking checks, triaging the backlog and accepting proposals are for people: there is no tool for them, and the API refuses an agent token that tries. Approving a card allows exactly the action written on it, and card text is treated as data, never as instructions.
Tokens and passwords, stored hashed
Agent tokens are scoped to projects, shown once, stored only as a SHA-256 hash and revocable at any time. Passwords are stored as Argon2id hashes. Your session lives in an HttpOnly, SameSite=Strict cookie sent only over HTTPS, and forms are protected against cross-site request forgery.
Every change is logged
Who did what, on which version, and when, in an append-only record. “Validated by Ana · 21:14” is always one tap away, for people and agents alike.
No trackers
ayedesk.com sets no cookies, loads no analytics or advertising scripts and makes no third-party requests. A strict Content Security Policy allows only our own scripts, styles, fonts and images, and the site cannot be framed by other sites. The app uses only the cookies that keep you signed in.
Infrastructure
The app runs on Amazon Web Services in the eu-west-3 region (Paris, EU), and ayedesk.com on Cloudflare. All traffic to the app passes through Cloudflare (CDN, proxy and tunnel) before it reaches AWS, and all traffic is encrypted in transit with TLS.
Data at rest is stored on AWS EBS volumes encrypted with AES-256. The database and attachments are backed up daily, and each backup is kept for 14 days.
Reporting a vulnerability
If you find a security issue, write to [email protected] with the details and how to reproduce it. Please don't access other people's data or disrupt the service while testing. We acknowledge every report within 3 business days.