Security at 2weeks
2weeks is built so that the people running the service cannot read your tasks. This page explains exactly what that means.
What is encrypted
Task titles, details, priorities, and attached files (including their names) are encrypted with a key that belongs to your account. The database, its backups, and the administrators only ever see ciphertext for these fields.
What is not encrypted
To draw your day grid and your Backlog, the server needs the shape of your schedule: the date, the time slot, the duration, and whether a task is done. Your email address is also stored in clear so you can sign in and recover your account. Someone with access to the database can see when you are busy, but not what you are doing.
How the keys work
- When you sign up or sign in, your browser runs Argon2id on your password. The password itself is never sent to us.
- From the result your browser derives two keys: one proves who you are, the other unwraps your account's data key.
- The server keeps the data key in memory only while you are signed in and unlocked. Locking, signing out, inactivity, or a server restart erases it.
- Your recovery key wraps the same data key. It is the only way to regain access if you forget your password.
What this does not protect against
While your session is unlocked, the application server holds your data key in memory to render your pages. An attacker who fully compromises the running server could read data for sessions that are unlocked at that time. We reduce this window with auto-lock, and we never write keys to disk or logs.
Everything else
- TLS everywhere, strict Content Security Policy, no third-party scripts or trackers.
- Rate limiting on sign-in and sign-up, and a security event log reviewed by the operator.
- Open questions or reports: [email protected].