Security

Your Credentials

ClickUp tokens are envelope-encrypted at rest — a unique data key per connection, wrapped by a master key — and never returned to a browser after you save them. Support staff cannot read them. You can disconnect a workspace at any time, which removes the stored credential.

Your Data

Every tenant's rows are isolated with database row-level security enforced by the database itself, not just application filters. Export files live under tenant-scoped storage paths and are reachable only through short-lived, authorized links. Files expire under your plan's retention and are then removed.

Accountability

Meaningful actions — sign-ins, connection changes, runs, downloads, plan changes, and every administrative touch — are recorded in append-only audit logs. If Kodavara support ever enters your account, you see a banner, the session is time-boxed, sensitive actions are disabled, and the whole visit is on the record.

Payments

Card details never touch our servers — checkout and billing run on Stripe.

Questions? Send us a message · Read the Privacy Policy

Home → Security