Infrastructure

gantt-chart.io runs on Cloudflare Workers — a globally distributed edge runtime with built-in DDoS protection, TLS termination, and no exposed origin servers. All traffic is encrypted in transit via HTTPS/TLS 1.3.

Data storage

Project data is stored in Cloudflare D1, a serverless SQLite database with automatic encryption at rest. Data is replicated within Cloudflare's infrastructure and not stored on any third-party servers beyond Cloudflare.

Authentication

Access to your projects requires authentication. Sessions are bound to your authenticated email address. Requests without valid credentials receive a 401 response and cannot access project data.

AI file validation

Files uploaded for AI analysis are validated before processing: allowed extensions are checked, file signatures are verified (PDF, DOCX, XLSX), and size is capped at 8 MB per file and 20 MB per request. Files are not persisted after the AI request completes.

Share links

Share links expose a read-only snapshot of a project. They:

Are identified by a cryptographically random UUID
Expire after 30 days by default (maximum 365 days)
Can be deleted by the project owner at any time
Do not expose authentication credentials or account data

Payments

All payment processing is handled by Stripe. gantt-chart.io never sees, stores, or logs card numbers or CVVs. Webhook signatures are verified using HMAC-SHA256 before any subscription state is updated.

Secrets management

API keys and credentials are stored as encrypted Cloudflare Worker secrets, not in source code or environment files. Secrets are rotated on a regular schedule.

Dependency and build security

We use gitleaks pre-commit scanning to prevent accidental credential exposure. Dependencies are pinned and reviewed before updates.

Responsible disclosure

If you discover a security vulnerability, please report it privately via our contact page before disclosing publicly. We will acknowledge reports within 3 business days and work to resolve confirmed issues promptly. We do not currently operate a bug bounty program.

Questions

Security questions: contact us.