Security at Dunyo

Last Updated: October 30, 2026

Dunyo holds your team's people and project data, so we treat its security as part of the product. This page summarizes how we protect it. The binding commitments are in our Data Processing Addendum, and the full list of measures is in its Annex II.

Infrastructure

Hosting: the application and database run on dedicated servers from Akamai Cloud (Linode) in Washington, DC, United States. Production is separate from staging and development, and non-production environments never hold customer data.
Network: the API is reachable only through Cloudflare, which provides TLS termination, DDoS protection and web application firewall rules. Servers sit behind a provider firewall plus a host firewall, and SSH access is key-only with root login disabled.
Non-production access: staging and internal tools are protected by Cloudflare Zero Trust access controls.

Data protection

Encryption in transit: all traffic uses TLS 1.2 or higher.
Encryption at rest: production servers, including the database, use full-disk encryption. File attachments are stored in object storage encrypted with AES-256.
Backups: the database is backed up every night. Backups are encrypted with age (X25519 and ChaCha20-Poly1305) before they leave the server and are kept in separate off-site storage. The decryption key is never stored on the server, and restores are tested periodically.
Payments: card details are handled entirely by Stripe and never reach Dunyo's servers.
No AI training: we do not use customer data to train machine learning or AI models.

Application security

Authentication: passwords are stored only as bcrypt hashes. Users can sign in with Google or passkeys (WebAuthn), and can turn on TOTP two-factor authentication.
Sessions: sessions use HttpOnly, Secure cookies.
Access control: workspace roles limit what each member can see and change, and every workspace's data is isolated from every other workspace.
Audit log: changes in a workspace are recorded in an audit log that workspace admins can review.
Rate limiting: the API applies rate limits to protect against abuse and brute-force attempts.
Dependencies: every pull request is checked for newly introduced packages with known vulnerabilities.

Operations

Monitoring: application, infrastructure and security events are logged and monitored, with alerts.
Availability: live uptime and incident history are on our status page.
Incident response: we follow a documented incident response process. If a breach affects your personal data, we notify you within 48 hours of becoming aware of it, as committed in the DPA.
Staff access: Dunyo staff access production data only when needed to provide support or operate the service, using individual accounts with two-factor authentication. Everyone with access is bound by confidentiality obligations.

Privacy and compliance

GDPR, UK GDPR and Swiss FADP: our DPA includes the EU Standard Contractual Clauses, the UK Addendum and Swiss transfer terms, and applies automatically when you accept our Terms.
CCPA: Dunyo acts as your Service Provider and does not sell or share your personal data.
Subprocessors: the third parties that process customer data are listed on our Subprocessors page. We give 14 days' notice before adding or replacing one.
Privacy: see our Privacy Policy.

Vulnerability disclosure

If you believe you have found a security vulnerability in Dunyo, please email [email protected] with the details and steps to reproduce. We will acknowledge your report, keep you informed while we investigate, and credit you if you wish.

Please act in good faith: do not access, change or delete other people's data; do not degrade the service (no denial-of-service or high-volume automated testing); and give us reasonable time to fix the issue before disclosing it. We will not pursue legal action against research that follows these guidelines.

Our machine-readable contact is published at /.well-known/security.txt.

Questions

For security questionnaires, a countersigned DPA, or anything else about security, contact [email protected].