Legal
Security
Version 2026-10-05 · Effective October 5, 2026 · Legal owner: Josue Phillips, legal representative of Donefy Corp · Security owner: Donefy development team
Our Commitment to Security
At donefy, security is foundational — not an afterthought. We design every layer of our platform with the understanding that your business data is sensitive and valuable. We continuously review and improve our security practices to protect your information.
Data Encryption
All data transmitted between your browser and donefy is encrypted using TLS. Stored files are encrypted at rest, and sensitive fields such as integration credentials and tax IDs are encrypted individually. Your data is backed up daily, and backups are encrypted and access-restricted.
Access Controls
donefy enforces role-based access control (RBAC) across all accounts. Administrators can define granular permissions for each team member, and deactivating a user blocks their access from their next request. After the password, every sign-in asks for a second factor — a code by email or from an authenticator app, a text message where available, or a passkey such as Face ID or Touch ID — except on a device you chose to remember, which skips the code there for 30 days. Sensitive areas ask you to confirm your identity again, and you can sign out of all your sessions and remembered devices at once.
Infrastructure
Our platform runs in data centers operated by a leading cloud provider whose facilities are independently audited, including SOC 2. We are building our own security program toward an independent SOC 2 audit of donefy itself. Sign-in attempts and changes to key business records are recorded in audit logs; a workspace's activity log is kept for one year.
Tenant Data Isolation
Each customer's business data is kept in its own database, separate from every other customer's, and every request is checked against the workspace it belongs to. A few platform services, such as sign-in, are shared by all customers.
Vulnerability Disclosure
If you discover a security vulnerability, please report it to security@donefy.io. We review every report we receive. We ask that you give us reasonable time to resolve the issue before any public disclosure.
Contact
For security-related inquiries, reach out to our security team at security@donefy.io.