Security

How we protect your projects and data.

Infrastructure

gantt-chart.io runs on Cloudflare Workers, a globally distributed edge runtime with managed TLS termination and no application-managed origin server. Supported clients connect over HTTPS using TLS 1.2 or newer.

Data storage

Project data is stored in Cloudflare D1, a serverless SQLite database with automatic encryption at rest. Data is replicated within Cloudflare's infrastructure and not stored on any third-party servers beyond Cloudflare.

Authentication

Access to your projects requires authentication. Sessions are bound to your authenticated email address. Requests without valid credentials receive a 401 response and cannot access project data.

AI file validation

Files uploaded for AI analysis are validated before processing: allowed extensions are checked, file signatures are verified (PDF, DOCX, XLSX), and size is capped at 8 MB per file and 20 MB per request. Files are not persisted after the AI request completes.

Share links

Share links expose a read-only snapshot of a project. They:

  • Are identified by a cryptographically random UUID
  • Expire after 30 days by default (maximum 365 days)
  • Can be deleted by the project owner at any time
  • Do not expose authentication credentials or account data

Payments

All payment processing is handled by Stripe. gantt-chart.io never sees, stores, or logs card numbers or CVVs. Webhook signatures are verified using HMAC-SHA256 before any subscription state is updated.

Secrets management

API keys and credentials are configured as Cloudflare Worker secrets rather than committed to source control.

Dependency and build security

CI runs secret scanning, linting, tests, and production builds. Dependency versions are recorded in the lockfile for repeatable installs.

Responsible disclosure

If you discover a security vulnerability, please report it privately via our contact form before disclosing publicly. Include reproduction steps and impact, but do not access other users’ data or disrupt the service. We do not currently operate a bug bounty program or promise a specific response time.

Questions

Security questions: contact us.