Security

Encryption

All traffic to and from Tovo is encrypted in transit with TLS. Data stored in our database is encrypted at rest by our managed database provider.

Authentication & request verification

• Installation uses Slack’s standard OAuth flow; sign-in uses Slack OIDC. We never see or store your Slack password.
• Every inbound request from Slack (commands, interactivity, events) is verified against Slack’s signing secret before it is processed, so forged requests are rejected.
• OAuth tokens are stored server-side and used only to perform the actions you initiate.

Least-privilege access

We request only the Slack scopes the app needs to function. Within Tovo, write access to the database is restricted to server-side code using a privileged key that is never exposed to the browser; the client has read-only access scoped to the signed-in user’s workspace. You can review and revoke the app’s permissions at any time from your Slack workspace settings.

Infrastructure & subprocessors

Tovo runs on reputable, security-conscious infrastructure providers:

• Vercel — application hosting and serverless compute.
• Supabase — managed PostgreSQL with encryption at rest, plus authentication.
• Anthropic — AI parsing of messages you send to the bot; your content is not used to train models.
• Merchant-of-Record payment processor — handles checkout and billing, so card data is processed by a PCI-compliant provider and never touches our servers.

See our Privacy Policy for the full list of subprocessors and how data is used.

Data handling & retention

We collect only the workspace, channel, user, and checklist data needed to operate the service. When you uninstall Tovo, the app’s access is revoked and we delete or anonymize your workspace data within 30 days, subject to limited legal retention. You can request export or deletion anytime — see Support.

AI processing

Our AI provider is Anthropic (Claude). Content is sent to it only for the four purposes below, is used solely to fulfil that request, and is not used to train models.

• Plain-English authoring — the message text you direct at the bot (by mentioning or DMing @tovo), plus the workspace roster used to resolve owners, is parsed into a structured checklist.
• Thread context— a free-form reply in a run’s thread is parsed into notes, changelog entries or sub-steps. Explicit changelog: / note: / step: commands are matched by a plain parser and never reach the model.
• Activity-log lines — whenever a run event fires, the run name and its task titles, statuses and owner IDs are sent so the update can be phrased in a natural voice. This happens for every run, including runs started from a saved template.
• Refund screening — a refund request you submit on /refund is screened against your account facts.

Accuracy. AI output can be wrong. Tovo may misread your message and produce an inaccurate, incomplete or unexpected checklist, owner, due date or log line, so review what it drafts before relying on it — especially for anything safety-, security- or compliance-critical. A drafted checklist is shown to you as a preview and is created only after you press Confirm; context you add in a run’s thread applies immediately, with no preview. Starting a run with /tovo start skips the AI drafting step, but its activity-log lines are still phrased by AI.

Responsible disclosure

If you believe you’ve found a security vulnerability in Tovo, please email support@tovo.runwith the details. We’ll acknowledge your report, investigate promptly, and keep you informed. Please give us a reasonable opportunity to address the issue before any public disclosure.

Contact

Security questions or compliance requests? Reach us at support@tovo.run.