Security
Information Security Policy
Owner: TaskLinkr (tasklinkr.co), operated by Jason Opland. Contact: [email protected]. Last reviewed: November 3, 2026.
01Scope
Scope
This policy covers the TaskLinkr website, directory, and agent interfaces (including its MCP server), and the business and account data they process.
02Access control
Access control
Access to production systems is role-based and limited to the people who operate the service, on a least-privilege basis. Administrative access requires individual accounts; shared administrative credentials are not used.
03Third-party connections and credentials
Third-party connections and credentials
Businesses connect third-party systems (such as booking and point-of-sale platforms) by authorizing access through OAuth with our integration provider. TaskLinkr does not receive, see, or store businesses' passwords for third-party services. Connection tokens are held by the integration provider and used only within the scopes the business authorized, and a business can disconnect at any time, which ends our access.
04Encryption
Encryption
Data is encrypted in transit using TLS. Data at rest is held with our cloud hosting and database providers, which encrypt stored data at rest. Payment card data is processed by Square and is not stored by TaskLinkr.
05Data handling
Data handling
Business records display provenance and verification status. Personal information is collected and shared as described in our Privacy Policy and is never sold.
06Vendors
Vendors
We use established cloud, email, payment, and integration providers. We review the security posture of providers that process directory or account data and limit each provider to the data its function requires.
07Backups and availability
Backups and availability
Production data is backed up through our hosting and database providers, and restoration is tested when configurations change.
08Incident response
Incident response
Suspected security incidents are investigated on discovery. If an incident involves personal information, we notify affected parties and regulators without unreasonable delay, as applicable law requires, and record the incident and remediation.
09Certifications — stated plainly
Certifications — stated plainly
TaskLinkr does not currently hold SOC 2 or ISO 27001 certification. This policy describes the controls in place today; it will be updated as the program matures.