Security and compliance
Taskforce.sh Inc., the BullMQ team's US company, sells Taskforce.sh and BullMQ Pro and is SOC 2 Type II certified and GDPR compliant. This page explains how Taskforce.sh reaches your queues, what it stores, and how you control access.
Certifications
The certifications cover the company, so they apply to Taskforce.sh and to BullMQ Pro.
SOC 2 Type II
Independently audited controls for security, availability and confidentiality. The report is available on request.
GDPR
Compliant with EU data protection rules, with a data processing agreement.
Trust Center
Current controls and policies are listed at trust.taskforce.sh.
On-premises
Run Taskforce.sh on your own infrastructure and keep your queue data in your network. On-premises edition.
How Taskforce.sh reaches your queues
Choose per connection between a direct Redis connection and the Taskforce Connector.
Direct connection
You provide a Redis connection URL, optionally with TLS. Taskforce.sh connects to that Redis to read your queues. Use it for Redis instances that are already reachable over the internet, such as managed Redis with TLS.
Taskforce Connector
An open source process that runs next to your Redis and opens an outgoing encrypted WebSocket connection to Taskforce.sh. Redis is never exposed to the internet and no inbound port is needed. It works with Redis on localhost, in private networks, with Sentinel and with Redis Cluster, and with BullMQ v6 queues on PostgreSQL.
Data and access
What is stored
- Job payloads are not stored on Taskforce.sh servers. They are read from your Redis when you open them.
- Connection credentials are stored encrypted.
- Taskforce.sh and the Taskforce Connector always use TLS, and direct Redis connections use it when you enable it.
Teams and roles
Connections belong to organizations and teams. Custom roles are built from 12 permissions, so each member only gets the actions they need, for example viewing jobs without retrying or deleting them. Custom roles.
AI agents
Agents connect over the Model Context Protocol as non-human team members, with their own tokens. Give them read-only or scoped write permissions. Every action they take is recorded in an audit log.
Protecting the data in your jobs
Taskforce.sh only shows what is in your queues, so the most effective protection is to keep secrets out of job data. If a job really needs confidential data, encrypt it with a key that is not stored in the job.
The security primer has more recommendations for running BullMQ and Redis in production.
Security questions
Need a security questionnaire or the SOC 2 report? Contact us.
Yes. Taskforce.sh Inc. is SOC 2 Type II certified. The report is available on request, and the current controls are listed in the Trust Center.
Yes. The certification covers Taskforce.sh Inc., the BullMQ team's US company, which sells and supports both Taskforce.sh and BullMQ Pro.
No. With the open source Taskforce Connector, Redis stays in your private network. The connector opens an outgoing encrypted WebSocket connection to Taskforce.sh, so no inbound port is needed.
Job payloads are not stored on Taskforce.sh servers. They are read from your Redis when you look at them in the dashboard. Connection credentials are stored encrypted.
Yes. Taskforce.sh is GDPR compliant and provides a data processing agreement.
Yes. AI agents connect over the Model Context Protocol with their own tokens. Each agent gets read-only or scoped write permissions, and its actions are recorded in an audit log.
Yes, with the on-premises edition, which runs on your own infrastructure with Docker or on AWS. Only its license is checked with taskforce.sh, every 15 minutes.
Try Taskforce.sh for free
Connect your queues in a few minutes, with Redis kept private behind the Taskforce Connector.
15-day free trial · No credit card required
