Projectant is built with security as its primary requirement. We leverage Google's global enterprise infrastructure to provide a level of security typically reserved for large corporations.
Every project is logically siloed. We use Firebase Security Rules to enforce "Row-Level Security." Even if a hacker has your project ID, they cannot access data without an authorized UID check performed directly on Google's servers.
Data is protected by 256-bit AES encryption at rest. In transit, we use TLS 1.2+ (SSL) to ensure that your project plans and notes can never be intercepted on public Wi-Fi.
Your payment details never touch our servers. We use Stripe, a PCI Level 1 Service Provider. We only store a secure token representing your subscription status.
Our use of Cloud Firestore eliminates entire classes of web vulnerabilities. There is no traditional SQL database, making classic "injection" attacks technically impossible.
Data Sovereignty & Portability
We believe your data belongs to you. Unlike many platforms that lock your data in, Projectant provides full export features:
- Full JSON Backup: Download every single piece of data in your project in a machine-readable format.
- CSV Reporting: Export your budget tracker, change log, and questions for management reporting.
- Right to be Forgotten: Deleting your account permanently wipes all your personal projects and profile from Google's disks immediately.
While your API keys are visible in the web browser, they are not "secrets." Security is maintained by restricting where and how they can be used.
1. Restrict API Keys in Google Cloud
- Navigate to Google Cloud Console > APIs & Services > Credentials.
- Find the Browser key (auto-created by Firebase).
- Under Application restrictions, select "Websites" and add
projectant.co.ukandlocalhost. - Under API restrictions, select "Restrict key" and choose only: Identity Toolkit API, Cloud Firestore API, and Google Cloud Storage.
2. Monitor Usage & Billing
Setting a budget alert (like your $50 cap) is excellent. You can also view real-time usage for each API in the APIs & Services > Dashboard to see if any unexpected traffic is occurring.
3. Never Commit "Service Account" JSON
The firebaseConfig object is safe to share. However, if you download a Service Account Key (JSON file) for admin scripts, never add it to Git. This file has root access and can bypass all security rules.
The "Q & Clarifications" section is designed to capture and resolve uncertainties within your project.
- Raising a Question: Click "Raise Question" to submit a query. You can select whether it is a General project question or specifically Task-related.
- Linking to Tasks: If a question is task-related, you can link it directly to an item from your To-Do list. This helps provide context for why the question is being asked.
- Ownership: You can assign an "Owner" to each question. This person is responsible for hunting down the answer and updating the resolution field.
- Deadline Tracking: Use the "Required Date" field to signal when an answer is needed to avoid project delays.
Accurate budgeting is about more than just listing costs; it's about managing uncertainty and variance.
- Contingency Buffer: In Project Overview, you can set a contingency percentage (Prince2 recommends 10-15%). This is your "insurance policy" against scope creep and unexpected risks.
- Base vs. Contingency: Your dashboard shows your "Base Working Budget." If your actual spend exceeds this, the bar turns orange to warn you that you are consuming your risk buffer.
- Variance Analysis: The "Variance" column in the budget tracker shows the gap between your Allocated (Planned) cost and Actual (Spent) cost.
Inviting a user to your project is a simple one-step process:
- Send the Invitation: In your project, go to the 'People' page. Use the 'Invite Collaborators' form to add the person's email address and click 'Invite'.
An email will be sent to them containing a link. When the user clicks the link, they will be prompted to sign up or log in. If they use the same email address you invited, they will automatically gain access to the project and appear on your dashboard as a project member.
The "People" section allows you to assign roles to users, controlling what they can see and do.
- Owner: The project creator. Has full control over everything, including project settings and permanent deletion. There can only be one owner.
- Admin: Has full edit access to all project content and settings, just like the owner. The only thing an Admin cannot do is permanently delete the project.
- Collaborator: A standard team member. Collaborators can create and edit content like notes, tasks, events, and data tables.
- Contact: This is an informational role only. People assigned as 'Contact' are listed in the 'People' section for reference but have no access to the project itself.
Project deletion is a two-step process to prevent accidental data loss.
- Schedule for Deletion: In 'Project Settings', only the project owner can choose to 'Schedule Project for Deletion'. This marks the project for deletion but does not remove it immediately.
- Recovery Period: Once scheduled, the project enters a 7-day recovery period. It will appear in the "Recently Deleted" section on your main dashboard.
- Permanent Deletion: After 7 days, the project is permanently and irretrievably deleted.