Take the 2-minute tour ×
Web Applications Stack Exchange is a question and answer site for power users of web applications. It's 100% free, no registration required.

I started using Trello at work to manage my team and liked it, but then my my VP Dev told me we can't store any company information offsite because of regulations (we're working with the finance industry). Trello is not hostable locally, so I'm out of options.

If I'm going to try and work around this, I need to at least know that all the data is encrypted somehow on the Fogbugz servers, or wherever they use for storage.

Does anybody have any information on that?

share|improve this question
    
There is no such guarantee. You can read the Trello ToS here, particularly the section named NO WARRANTIES OR REPRESENTATIONS BY FOG CREEK –  kraymer Sep 20 '11 at 8:17
add comment

2 Answers

up vote 8 down vote accepted

Please see http://trello.com/data for our data, privacy, and security policies and our Terms of Service for the document covering your interaction with Trello and Fog Creek.

We may offer enterprise-grade security for payment in the future. That will come with documentation, representations, etc. In any case, Trello will remain a software-as-a-service offering. If your company or government regulations prevent you from having data outside your network or servers, unfortunately, you won't be able to use Trello.

share|improve this answer
2  
Not to sound rude, but such a promise isn't really worth anything when it comes to corporate polices. It would be nice to have a way to make it technically impossible for non-members to view content on the boards –  Isak Savo Sep 21 '11 at 11:46
1  
Thanks for the answer. I have to agree with Isak - that's not gonna cut it, sadly for me. –  Ninjarabbi Sep 21 '11 at 13:48
add comment

For what it is worth, there is a way to encrypt a text subset of Trello using Greasemonkey: http://userscripts.org/scripts/show/173422

The script runs in a browser and intercept text nodes, encrypting and decrypting them using AES. The description of the script contains some discussion on the level of security that may be achieved with this approach. It boils down to "pretty good" security assuming that the server does not actively attempt to decrypt the data or obtain the AES key.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.