Infrastructure
gantt-chart.io runs on Cloudflare Workers, a globally distributed edge runtime with managed TLS termination and no application-managed origin server. Supported clients connect over HTTPS using TLS 1.2 or newer.
Data storage
Project data is stored in Cloudflare D1, a serverless SQLite database with automatic encryption at rest. Data is replicated within Cloudflare's infrastructure and not stored on any third-party servers beyond Cloudflare.
Authentication
Access to your projects requires authentication. Sessions are bound to your authenticated email address. Requests without valid credentials receive a 401 response and cannot access project data.
AI file validation
Files uploaded for AI analysis are validated before processing: allowed extensions are checked, file signatures are verified (PDF, DOCX, XLSX), and size is capped at 8 MB per file and 20 MB per request. Files are not persisted after the AI request completes.
Share links
Share links expose a read-only snapshot of a project. They:
- Are identified by a cryptographically random UUID
- Expire after 30 days by default (maximum 365 days)
- Can be deleted by the project owner at any time
- Do not expose authentication credentials or account data
Payments
All payment processing is handled by Stripe. gantt-chart.io never sees, stores, or logs card numbers or CVVs. Webhook signatures are verified using HMAC-SHA256 before any subscription state is updated.
Secrets management
API keys and credentials are configured as Cloudflare Worker secrets rather than committed to source control.
Dependency and build security
CI runs secret scanning, linting, tests, and production builds. Dependency versions are recorded in the lockfile for repeatable installs.
Responsible disclosure
If you discover a security vulnerability, please report it privately via our contact form before disclosing publicly. Include reproduction steps and impact, but do not access other users’ data or disrupt the service. We do not currently operate a bug bounty program or promise a specific response time.
Questions
Security questions: contact us.