Secure your Taskploy workspace
Taskploy provides role-based access, approval workflows and activity history to help you protect business data. Security also depends on how your team configures accounts and permissions. This guide covers practical steps for workspace administrators.
One workspace, one company
Each Taskploy account represents a single company workspace. Customer, employee, invoice and project records are shared within that workspace according to roles you assign. If you operate multiple legal entities, each generally needs its own workspace and subscription.
Assign the minimum access needed
- Review default roles in Settings → Users & roles.
- Grant module access only where required — for example, not every user needs finance or payroll.
- Limit administrative roles to people who manage billing, users or workspace settings.
- Use approval permissions so only designated reviewers can approve expenses, leave or purchases.
See Roles and permissions for a full overview.
Protect sign-in
- Use strong, unique passwords for every user account.
- Enable multi-factor authentication where available, especially for administrators.
- Do not share login credentials between employees.
- Sign out on shared devices.
If single sign-on (SSO) is available on your plan, consider enabling it for centralized access control.
Offboard promptly
When someone leaves your organization:
- Deactivate or remove their user account immediately.
- Review open approvals assigned to them and reassign if needed.
- Rotate shared integration or API credentials they may have accessed.
- Confirm they no longer receive workspace notifications.
Review access regularly
Schedule a quarterly access review: list active users, their roles, and whether each still needs that level of access. Remove unused accounts and downgrade permissions where roles have changed.
Use approvals for sensitive actions
On Professional and Ultimate plans, configure approval workflows for expenses, leave, purchases and other requests that should not proceed without review. This creates a clear record of who submitted, approved or rejected each request.
Integrations and API access
- Connect only integrations your organization has approved.
- Store API keys and webhook secrets securely — not in shared chat or email.
- Remove integrations you no longer use.
- Review integration permissions when vendors update their scopes.
Train your team
- Recognize phishing attempts that impersonate Taskploy or payment providers.
- Verify wire or payment changes through a second channel before acting.
- Report suspicious sign-in activity or unexpected account changes to your administrator.
Report a security concern
Workspace users should contact their internal administrator first for access issues. To report a potential vulnerability in Taskploy itself, email security@taskploy.com. Do not include sensitive exploit details in general support tickets.