Gregory Thomas Dobson trading as Seven ABN 77 474 138 379
Version 1.2 (DRAFT) Last updated: 9 August 2026
This statement describes the security measures applied to Seven and identifies the third parties that process customer data on our behalf. It is referenced by the Seven End User Service Agreement and the Seven Privacy Policy, and is intended to give prospective and current customers an accurate account of how the service is built and operated.
Seven is a small, independently operated service. This statement describes controls that are proportionate to that scale and does not claim certification against ISO 27001, SOC 2 or any comparable framework. Where a control commonly expected of a larger provider is not in place, that is stated plainly in section 8 rather than left for a customer to discover.
Seven is a web application, used in any modern browser. A desktop client is planned; when offered, it will be a thin wrapper that loads the hosted application and holds no local copy of the database.
| Layer | Technology |
|---|---|
| Client | React 18, Vite, served as static assets |
| Server | Node.js, Express, TypeScript |
| Database | SQLite, file-persisted on the application server |
| Authentication | JSON Web Tokens, with passwords hashed using bcrypt |
| Payments | Stripe checkout, webhooks and customer portal |
| File attachments | Stored on the application server file system |
All customer data resides in a single database on the application server. Seven does not operate a data warehouse or advertising infrastructure, and customer data is not copied to any system other than those listed in section 6.
Seven uses Google Analytics 4 for web usage measurement on its website and application pages. This is measurement of page traffic only: it records which pages are visited and basic browser, device and approximate location information, and it does not receive the content held in the database. Application page addresses do not embed customer record names, and single-use security tokens are stripped from the reported address. Google is listed as a sub-processor in section 6.
2.1 Passwords are hashed with bcrypt before storage. Plain-text passwords are never written to the database or to application logs.
2.2 Authenticated sessions use signed JSON Web Tokens with a seven-day expiry. Tokens are held in browser storage on the user's own device.
2.3 Every application endpoint other than registration, login and the payment provider's webhook requires a valid token.
2.4 Access to workspaces, boards and records is scoped to the accounts entitled to them, and administrative functions are restricted to accounts holding an administrator role.
2.5 Tokens are validated against current account state on each request, so access is refused immediately for accounts that have been deleted or suspended, without waiting for the token to expire.
2.6 Machine-to-machine access is presently limited to a single administrator-scoped service key used by the operator's own automation. It is disabled unless explicitly configured. Per-user API keys, which would allow each customer to generate and revoke their own credentials, are specified but not yet implemented; until they ship, customers cannot obtain machine access to their own data other than through the application's export functions.
2.7 Administrative access to the underlying server is restricted to the operator, over SSH using key-based authentication.
2.8 The production server refuses to start unless a strong, unique token signing secret is configured, which prevents a misconfigured deployment from signing or accepting tokens using a default value.
3.1 All connections between clients and the application are encrypted in transit using TLS. Certificates are issued and renewed automatically.
3.2 The database file and uploaded attachments are stored on the application server's file system and are protected by the operating system's access controls and the hosting provider's platform controls. The database is not separately encrypted at rest at the application layer. Section 8 records this as a known limitation.
3.3 Payment card details never reach Seven's servers. Card data is entered directly with our payment provider, and Seven receives only a customer reference and subscription status.
4.1 Application activity is logged to support audit trails, notifications and incident investigation. Logs are reviewed following any suspected incident, and credentials and token values are excluded from them.
4.2 Operating system and dependency updates are applied on a regular basis, with security-relevant updates prioritised.
4.3 Deployments follow a documented runbook that includes taking a database backup before each release.
4.4 Application-level rate limiting is specified but not yet implemented. Section 8 records this as a known limitation.
5.1 The database and uploaded attachments are backed up daily by a scheduled job, which first checkpoints the database write-ahead log so that the captured copy is consistent. A further backup is taken before each deployment.
5.2 Backups are retained for 90 days and then removed.
5.3 Backups are used for whole-system recovery. Restoration of an individual account or record from backup is not offered as a routine service, and customers should use the application's export functions to maintain their own copies of anything they cannot afford to lose.
5.4 Backups are held in two places. The daily job described in 5.1 writes to storage on the application server itself, which allows a fast, granular restore of the database without disturbing the rest of the system. Separately, the hosting provider takes whole-server snapshots and retains them off the server, on its own schedule and retention terms, which protects against the loss or destruction of the server itself.
The following third parties process customer data on Seven's behalf. Seven will give customers at least 30 days' notice before adding a new sub-processor that will process customer content.
| Sub-processor | Function | Data processed | Location |
|---|---|---|---|
| Hostinger | Application hosting, storage and domain services | All customer data stored in the application, including account records, content and attachments | Outside Australia. See section 7. |
| Stripe | Payment processing and subscription management | Name, email address, billing details and payment card data, entered directly with Stripe | United States and other locations per Stripe's own terms |
| Google (Google Analytics 4) | Web usage measurement on the website and application pages | Page address and title, referring page, IP address and the approximate location derived from it, and browser, device and language settings. No content held in the application. | United States and other locations per Google's own terms |
The following are not currently engaged. They are listed so that customers can anticipate the effect of features presently in development, and each will be confirmed by notice before it processes customer data.
| Party | Function | Status |
|---|---|---|
| Microsoft | Two-way calendar synchronisation with Outlook | Specified but not implemented. Would apply only to accounts that choose to connect a calendar, and would involve disclosure of scheduled task details to the customer's own Microsoft tenancy. |
Seven's planned integration with Claude operates in the opposite direction to a conventional integration, and does not make Anthropic a sub-processor of Seven. Where a customer connects their own Claude application to Seven, that application runs under the customer's own subscription and credentials, and calls Seven's interface using a key issued to that customer. Seven does not send data to Anthropic, does not hold Anthropic credentials, and does not receive or store the customer's mailbox credentials. The customer's relationship with Anthropic is governed by the customer's own agreement with that provider. This integration depends on the per-user API keys described in section 2.6 and is not yet available.
7.1 Customer data is stored on infrastructure operated by Hostinger. Hostinger does not currently operate a data centre in Australia; its server locations comprise sites in Europe, Asia, North America and South America. Customer data is therefore stored and processed outside Australia.
7.2 This constitutes a cross-border disclosure for the purposes of Australian Privacy Principle 8. Seven relies on the hosting provider's contractual data protection commitments as the reasonable steps required by that principle, and discloses the arrangement in the Privacy Policy and in the End User Service Agreement so that customers can make an informed decision.
7.3 The current server region is recorded here and updated when it changes: [REGION TO BE CONFIRMED ON MIGRATION]. Customers will be given notice before the region changes.
7.4 Customers subject to a data sovereignty requirement, including some government, health and education bodies, should raise that requirement before subscribing. Seven cannot presently offer Australian-resident storage.
Stated deliberately, so that customers are not left to assume a control exists.
8.1 No encryption at rest at the application layer. The database and attachments rely on operating system and hosting platform controls rather than application-level encryption.
8.2 No contractual uptime guarantee. Seven is operated on a reasonable-endeavours basis without a service level agreement, and there is no formal high-availability or failover arrangement.
8.3 No multi-factor authentication for end users. Authentication is by password and token. Multi-factor authentication is not currently offered.
8.4 No independent security certification. Seven has not been audited against ISO 27001, SOC 2 or an equivalent standard, and no penetration test by an external party has been commissioned.
8.5 Single-region deployment. All data resides in one region on one provider, and there is no geographically redundant standby.
8.6 No application-level rate limiting. Protection against credential stuffing and automated abuse presently rests on platform-level controls rather than limits enforced by the application.
8.7 No per-user API keys. Machine access is limited to a single operator-held service key. Customers cannot yet issue or revoke credentials of their own.
8.8 Access tokens are held in browser storage. This is a common pattern for applications of this type, and it carries a known exposure to cross-site scripting compared with storage in an HTTP-only cookie.
8.9 Support is provided by a single operator. Response times outside Australian Eastern business hours, and during periods of leave, will be longer than the stated target.
Security is shared. Customers are responsible for:
10.1 Suspected incidents are triaged on identification, with priority given to containing unauthorised access and preserving evidence.
10.2 Where an incident affects customer data, Seven will notify the affected customers without undue delay and in any event within 72 hours of becoming aware, and will provide the information reasonably required for the customer to assess its own notification obligations.
10.3 Where an incident is likely to result in serious harm to an individual, Seven will notify affected individuals and, where applicable, the Office of the Australian Information Commissioner, in accordance with the Notifiable Data Breaches scheme.
10.4 A written summary of the incident, its cause and the remedial action taken will be provided to affected customers once the immediate response is complete.
Researchers and customers who identify a potential vulnerability are asked to report it to support@seventasks.net rather than disclosing it publicly, and to allow a reasonable period for remediation. Seven will acknowledge a report within two business days. Testing must not involve accessing data belonging to other customers, degrading the service for others, or any denial of service technique.
This statement is reviewed at least annually, and whenever the hosting arrangement, the sub-processor list, or a control described here materially changes.
Contact
Seven Gregory Thomas Dobson trading as Seven ABN 77 474 138 379 18 King Albert Avenue, Tanilba Bay NSW 2319
Email: support@seventasks.net Phone: +61 438 850 930 Web: seventasks.net