Security

Your team's estimates and backlog deserve care. Here is how Estimay protects them, what it does with the apps you connect, and how to report a problem if you find one.

Collect less, keep less

The safest data is data we never have. Estimay has no accounts, so there are no passwords or email addresses to steal, and no payment details, since none are needed to use it. A room holds only display names, stories and votes. It is deleted as soon as the host ends it, or automatically 7 days after it was last used (30 days for an async room), and we keep no backups of the database, so deleted data can't come back. None of it is ever given to advertisers.

Encryption

• In transit: everything between your browser and Estimay, including the live connection that carries votes, and every call Estimay makes to a connected app, is encrypted with HTTPS (TLS). Browsers are told to always use HTTPS for Estimay (HSTS).
• Integration tokens: the tokens a Slack workspace or a connected tracker gives Estimay are encrypted with AES-256-GCM before they are stored, each integration under its own key, which is derived from a secret kept outside the database. A copy of the database alone doesn't let anyone use them.
• Room passwords: stored only as a salted scrypt hash.

Votes stay secret until the reveal

Votes are kept on our server and are not sent to other participants' browsers until the cards are revealed, so they can't be read early, even with developer tools. Every participant receives their own copy of the room, prepared for them on the server. In anonymous rooms, individual votes are never sent to anyone; everyone receives only the totals per card. After the reveal, the server lets people change only their own card, and only if they voted.

Room access

• Room codes are generated with a cryptographically secure random generator, from about 28 million possible codes.
• For extra protection, hosts can set a room password. A connection that enters a wrong password five times is blocked.
• Permissions are enforced on the server for every action: only the host can choose facilitators, remove people and end and delete the room or hand it to someone else, and only the host and facilitators can manage stories, connect a tracker and import from it, reveal votes, run the discussion timer and change the deck, extra questions, disciplines and auto-reveal.
• The host can remove anyone from the room at once. Removing doesn't block the invitation link, so for a room only invited people should join, set a password.

Integrations

Every integration follows our Integrations Policy, which lists the permissions each one asks for. How they are protected:

• Sign-in on the provider's own page. Jira, Trello, Linear and Asana are connected with OAuth 2.0 and PKCE: you sign in with the provider, never with Estimay, and Estimay never sees your password. Each sign-in is tied to the browser that started it by a short-lived cookie, so a sign-in link can't be used to connect someone else's account to a room.
• Tokens never leave the server. A tracker connection belongs to the room, and its tokens are used only by our server to call the tracker. They never reach anyone's browser, and they are never written to our logs.
• Least access, used narrowly. Estimay asks for the narrowest permissions the provider offers, reads only what the import window shows and the items you pick, and writes only estimates. It can never do more in a tracker than the connected account is allowed to.
• Short-lived connections. Access tokens last an hour or a day and are renewed with refresh tokens, which most providers let work only once. A connection is deleted when the room is disconnected or ends, or after 30 days unused, and its tokens are revoked at the provider where it offers revocation (Linear and Asana). For Atlassian, which doesn't, you can remove Estimay from your Atlassian account's connected apps. If a provider refuses a renewal, the connection is dropped at once.
• Verified chat apps. Every request from Slack is checked against Slack's signature and refused if it is more than 5 minutes old, Telegram's launch data against its signature and age, and Discord's sign-in is completed on our server with Discord itself. Estimay then issues its own signed identity, which expires after a day.

Ads and third-party scripts

• No ads in rooms. Google's ad script runs only on public pages such as the home page and the blog. Rooms, the page where you create one, the contact form and our legal pages never load it, and neither does Estimay inside Slack, Discord, Telegram or Google Meet. Opening a room after a page with ads loads a fresh page, so the ad script doesn't follow you in.
• Estimay never sends room content (names, stories, votes) to Google or any advertiser.
• In a room, the only third-party script is Cloudflare's cookieless analytics, which receives the page address (containing the room's code) but no room content. Trustpilot's review box appears on the "Session ended" page, after the room has already been deleted.
• Advertising cookies are set only with your consent. See the Cookie Policy.

Infrastructure

Estimay runs on Railway, a cloud platform that is SOC 2 Type II certified, in its EU West region (Amsterdam, the Netherlands), application and database alike. The application reaches its database over Railway's private network, and credentials and keys are kept in Railway's environment settings, never in source code. Access to the production environment is limited to the operator.

Application safeguards

• A Content Security Policy that lets the browser run only Estimay's own scripts, Cloudflare's cookieless analytics script, Google's ad and consent scripts and the Buy Me a Coffee button (on public pages), Trustpilot's review box and, inside Telegram, Telegram's Mini App script. No other third-party code can load, and only the chat and video apps Estimay supports may show it in a frame.
• Security headers on every response, and rate limiting against abuse, including a limit on how fast anyone can send reactions.
• Every request is checked against a schema before it is handled, with length limits on everything you can type.
• Error messages that never reveal internal details.
• Automated tests and a check of production dependencies for known high-severity vulnerabilities run on every change to the code.

If something goes wrong

If we learn of a security incident, we contain it first: for example, we can disconnect every integration at once by making the stored tokens unreadable. If personal data is at risk, we report the breach to the Polish supervisory authority (UODO) within 72 hours where the GDPR requires it, and tell the people affected without undue delay when it is likely to put them at high risk. As there are no accounts or email addresses, we do so with a notice on estimay.io, directly where we have a way to reach you, and through the provider when an integration is concerned.

What you can do

• Share invitation links only with the people who may see the stories.
• Set a room password for sensitive sessions.
• Import only what everyone in the room may see, and leave out sensitive personal data and secrets.
• Connect a tracker with an account whose access suits the room, and disconnect it, or end the room, when you're done.
• Review the apps connected to your accounts in Atlassian, Linear, Asana, Slack or Discord from time to time, and remove those you no longer use.

Reporting a vulnerability

If you believe you've found a security issue in estimay.io, its API or its integrations, email [email protected] with "Security" in the subject, a description of the issue and steps to reproduce it. We'll acknowledge your report within 3 business days, keep you updated, and credit you once it's fixed if you'd like. Issues in the providers' own services belong with those providers.

Please act in good faith: don't access or change other people's data, don't run denial of service or social engineering attacks, and give us reasonable time to fix the issue before disclosing it. We won't take legal action against research done this way.

How we handle personal data is described in our Privacy Policy.