Security
Motionode is built to handle sensitive project context (requirements, timelines, discussions, and integrations). We focus on practical controls that reduce risk without slowing teams down: encryption, strict access control, safe credential handling, and clear data boundaries.
Encryption in transit for all traffic (TLS)
Encryption at rest for stored data (database + backups)
Role-based access control (RBAC) and project/org permissions
Tenant isolation at the application and data-access layer
Encrypted integration credentials (LLM keys, Git tokens), never intentionally exposed
Abuse protection (rate limiting and monitoring)
Data flow & boundaries
Motionode processes workspace data, optional collaboration data, and optional integrations. Third parties receive data only when you enable a feature.
Workspace data (core)
Collaboration data (optional)
- Task chat (Motionode chat)
- Per-task wireframes (Excalidraw-based)
- Per-task video calls (Dyte-based)
Integrations (optional / customer-enabled)
Infrastructure & hosting
Cloud hosting details
- Network controls (firewalling and restricted access to services)
- Encrypted storage for persistent data and backups
- Environment separation between production and non-production systems
- Operational monitoring for availability and suspicious patterns
- Backups designed to support restoration in case of failure
Hosting provider: DigitalOcean (U.S. regions by default). If you need a specific data region requirement, contact us.
Authentication & access control
How access is controlled
- Authenticated access for all user actions that touch workspace data
- Role-based permissions at the org/project level (owner/admin/member/guest)
- Least-privilege access patterns: users only see and act on data they're permitted to access
- Session protections including expiration and secure cookie/token handling
Tenant isolation
Multi-tenant data separation
- Org/project scoping is enforced in the application layer
- Data access is restricted by tenant boundaries in queries and APIs
- Permissions are validated server-side (not only in the UI)
Encryption
In transit & at rest
- In transit: TLS for browser↔API and service↔service communication
- At rest: encryption for stored workspace data, backups, and sensitive configuration
- Secrets protection: sensitive values are handled as secrets, not plaintext configuration
Sensitive credentials
LLM keys, Git tokens, integration secrets
- Encrypted at rest before storage
- Not intentionally logged (logs are designed to avoid secrets and payload leakage)
- Used only when needed to perform the requested action (export, sync, generate)
- Scope recommendations: we recommend using least-privilege tokens wherever possible
If you prefer not to store any credentials in Motionode, you can use features that support Bring Your Own Key or limit integrations to exports.
AI & model providers
How AI is used
The platform's core scheduling and delivery modeling is deterministic. AI is used where it helps (e.g., clarifying missing details, generating plan-aware outputs).
Bring Your Own LLM Key (recommended)
Motionode supports using your own API keys for OpenAI and Anthropic (Claude). When BYO is enabled:
- Requests are made using your credentials
- Motionode sends only the minimum data required for the feature
- Motionode does not use customer data to train public models
If AI is disabled
Collaboration providers
Video + wireframes
- Video calls are powered by Dyte (when you start a call)
- Wireframes are powered by Excalidraw-based tooling (when you open a wireframe)
Motionode stores the references and metadata required to attach these to tasks. The underlying media/collaboration data is handled by the respective provider during usage.
Rate limiting & abuse prevention
Protections
- Rate limits on APIs and sensitive endpoints
- Monitoring for unusual request patterns
- Protective controls designed to throttle suspicious traffic while allowing normal usage
Logging & incident response
How we handle incidents
- Operational logging is used to maintain reliability and troubleshoot issues
- Sensitive fields are avoided in logs by design
- Security events are triaged and investigated; we take prompt action to contain impact
If we become aware of a material security incident affecting customer data, we will notify impacted customers with available details and recommended actions.
Data retention & deletion
Your data, your control
- Workspace data is retained to provide the service
- Customers can request deletion of their workspace data
- We honor deletion requests consistent with legal, security, and operational requirements
For requests, contact: security@motionode.com
Subprocessors
| Provider | Purpose | When used |
|---|---|---|
| DigitalOcean | Hosting & infrastructure | Always |
| Dyte | Video calls | When you start/join a call |
| Excalidraw-based | Task wireframes | When you create/open wireframes |
| GitHub / GitLab | Source control integrations | When you connect a repo |
| OpenAI / Anthropic | AI features (BYO keys) | Only when enabled by customer |
A detailed list (including any analytics/email providers) is available on request.
FAQ
Do I need to invite my whole team?
Do I need to migrate from Jira or Asana?
What if my scope input is incomplete?
Do you train AI models on my data?
Security questions & vulnerability reporting
Report a vulnerability
Email: security@motionode.com
Subject: Security / Vulnerability Report
Please include: a clear description of the issue, steps to reproduce, potential impact, and any proof-of-concept details (if available). We review reports promptly and will coordinate remediation.