# Security overview

> Data is encrypted with AES-256 at rest and TLS 1.3 in transit. A workspace lives in the US or the EU region. Daily backups are kept for 35 days.

Source: https://stacklyhq.xyz/docs/security/overview

## Getting started

- [Quickstart](https://stacklyhq.xyz/docs/getting-started/quickstart)
- [Create a workspace](https://stacklyhq.xyz/docs/getting-started/create-a-workspace)
- [Invite your team](https://stacklyhq.xyz/docs/getting-started/invite-your-team)
- [Import from CSV](https://stacklyhq.xyz/docs/getting-started/import-from-csv)

## Concepts

- [Workspaces and projects](https://stacklyhq.xyz/docs/concepts/workspaces-and-projects)
- [Tasks and subtasks](https://stacklyhq.xyz/docs/concepts/tasks-and-subtasks)
- [Statuses and workflows](https://stacklyhq.xyz/docs/concepts/statuses-and-workflows)
- [Labels and priorities](https://stacklyhq.xyz/docs/concepts/labels-and-priorities)
- [Roles and permissions](https://stacklyhq.xyz/docs/concepts/roles-and-permissions)

## API reference

- [API overview](https://stacklyhq.xyz/docs/api-reference/overview)
- [Authentication](https://stacklyhq.xyz/docs/api-reference/authentication)
- [Pagination](https://stacklyhq.xyz/docs/api-reference/pagination)
- [Errors](https://stacklyhq.xyz/docs/api-reference/errors)
- [Tasks API](https://stacklyhq.xyz/docs/api-reference/tasks)
- [Projects API](https://stacklyhq.xyz/docs/api-reference/projects)
- [Comments API](https://stacklyhq.xyz/docs/api-reference/comments)
- [Users API](https://stacklyhq.xyz/docs/api-reference/users)
- [Stackly API reference (complete)](https://stacklyhq.xyz/docs/api-reference/full)

## Webhooks

- [Webhooks overview](https://stacklyhq.xyz/docs/webhooks/overview)
- [Webhook events](https://stacklyhq.xyz/docs/webhooks/events)
- [Webhook signatures](https://stacklyhq.xyz/docs/webhooks/signatures)
- [Webhook retries](https://stacklyhq.xyz/docs/webhooks/retries)

## SDKs

- [TypeScript SDK](https://stacklyhq.xyz/docs/sdks/typescript)
- [Python SDK](https://stacklyhq.xyz/docs/sdks/python)
- [Go SDK](https://stacklyhq.xyz/docs/sdks/go)

## Security

- **Security overview**
- [Single sign-on](https://stacklyhq.xyz/docs/security/sso)
- [Data retention](https://stacklyhq.xyz/docs/security/data-retention)

## Limits

- [Plan limits](https://stacklyhq.xyz/docs/limits/plan-limits)
- [Rate limits](https://stacklyhq.xyz/docs/limits/rate-limits)

1. [Docs](https://stacklyhq.xyz/docs)
2. Security
3. Security overview

# Security overview

Data is encrypted with AES-256 at rest and TLS 1.3 in transit. A workspace lives in the US or the EU region. Daily backups are kept for 35 days.

## Details

- Security questions go to security@stackly.test, which the security team reads every business day.
- Access to production data by Stackly staff is limited to the on-call engineers.
- Session lifetime is 14 days, and a password must be at least 12 characters.
- Admins must use two-factor authentication.
- The audit log on the Business plan records sign-ins, role changes and exports, and can be exported.
- You choose the data region, US or EU, when you create a workspace.
- Backups are taken daily and kept for 35 days.
- This page describes what Stackly does; it makes no claims about outside reviews of the company.
- Security questions go to security@stackly.test, which the security team reads every business day. (Security overview, note 2.)
- Access to production data by Stackly staff is limited to the on-call engineers. (Security overview, note 2.)
- Session lifetime is 14 days, and a password must be at least 12 characters. (Security overview, note 2.)
- Admins must use two-factor authentication. (Security overview, note 2.)
- The audit log on the Business plan records sign-ins, role changes and exports, and can be exported. (Security overview, note 2.)
- You choose the data region, US or EU, when you create a workspace. (Security overview, note 2.)
- Backups are taken daily and kept for 35 days. (Security overview, note 2.)
- This page describes what Stackly does; it makes no claims about outside reviews of the company. (Security overview, note 2.)
- Security questions go to security@stackly.test, which the security team reads every business day. (Security overview, note 3.)
- Access to production data by Stackly staff is limited to the on-call engineers. (Security overview, note 3.)

Every plan includes the Stackly API, so the steps on this page work on Free, Pro and Business.

## See also

- [Single sign-on](https://stacklyhq.xyz/docs/security/sso)
- [Rate limits](https://stacklyhq.xyz/docs/limits/rate-limits)

Next: [Single sign-on](https://stacklyhq.xyz/docs/security/sso)