Security and privacy
Time tracking data says a lot about people: where they work, when and for whom. This page explains how TimeTracking protects it, what we do not collect, and where to find the details. Our legal documents are being finalised; this page summarises what they commit to.
Company details
- Name
- TimeTracking
- KvK
- 84956526
- Address
- 31, 6165 BH Geleen, Netherlands
- Privacy requests
- privacy@timetracking.tech
- Security reports (responsible disclosure)
- security@timetracking.tech
GDPR and roles
TimeTracking is used by organisations: employers, staffing agencies and their clients. For the hours, placements and approvals your organisation stores in TimeTracking, your organisation is the controller and TimeTracking is the processor. We process that data only on your documented instructions, and the settings you choose in the app, such as whether location is on and how long it is kept, count as those instructions.
Our data processing agreement (DPA) is part of the terms and is accepted with them at sign-up. It covers confidentiality, security measures, breach notification, sub-processors, assistance with data subject requests, audits and deletion at the end of the contract. For account, billing and website data, TimeTracking is the controller, as described in the privacy policy.
EU hosting and sub-processors
Customer data is stored in the EU. The primary database runs on Supabase on AWS in Ireland (eu-west-1). The web app is hosted on Vercel, with functions in an EU region where possible; static content is served through a global CDN.
We publish every sub-processor with its purpose, location, transfer mechanism and status: live, or planned and only activated after notice. We notify customers at least 30 days before adding or replacing a sub-processor, and customers can object within that period. We use no advertising networks, no data brokers and no screenshot or keystroke tools.
Encryption
All connections, between browser, mobile app, API and database, use TLS 1.2 or higher, with HSTS on timetracking.tech. At rest, the database, file storage and backups use AES-256 disk encryption with provider-managed keys.
Magic links for approvals are 256-bit random tokens. We store only a hash of each token, links expire after 14 days, can be revoked, and are single use for approval.
Tenant isolation and access control
Every customer's data lives in the same database but is strictly separated. Each tenant table is protected by PostgreSQL row-level security (RLS), so the database itself refuses to return rows that belong to another organisation. The policies are tested per role in automated tests.
Inside an organisation, roles limit what people see. Employees can only read their own placements and hours, and a client contact only sees the placements within the scope of their link. Two-factor authentication protects admin roles. Access by our own staff to production data is limited to named people, only for support at your request or for incident handling, and every access is logged.
Audit log and signed approvals
Every change to timesheets, placements, periods, approvals, exports and conflicts is recorded in an append-only audit log: who changed what, when, from which source, with the old and new value. The audit log cannot be edited or deleted. Locked periods cannot be changed, only corrected with a new reference line, and exports carry a content hash so they can be reproduced.
When a client approves hours, they open a secure magic link and sign with a one-time code sent to their email. The approval records the signer's name, role, decision, time, IP address and browser. This is a simple electronic signature under the eIDAS Regulation, and it gives both sides a clear record of who agreed to which hours.
No screenshots, no keystrokes
TimeTracking does not take screenshots, record keystrokes or monitor which apps and websites people use. We think that kind of monitoring damages trust and is rarely proportionate under the GDPR.
TimeTracking does not collect location today. Geofence nudges are planned: when they arrive, location will be optional and switched on by the employer, and the app will capture a position only at clock-in, clock-out and when entering or leaving a geofence around a work site, never as a continuous trail. Raw coordinates will be kept for 30 days by default (configurable from 0 to 90), after which only inside or outside the geofence is kept. Planned push notifications will contain no hours or names.
AI processing
TimeTracking uses AI (Anthropic Claude) for features such as reading timesheets that clients email, flagging anomalies like impossible hours or duplicates, and categorising entries. AI output is always a suggestion. Extractions with low confidence go to human review, and the AI cannot approve, send or delete anything. Approvals, exports and payroll decisions are made by people.
Inbound email is treated as data: the model can only fill a fixed extraction schema and cannot trigger actions. Customer data is not used to train AI models. Running the model via AWS Bedrock in the EU (Frankfurt) is planned; until it is live, the sub-processor list shows the current status. You can switch AI features off for your organisation.
Backups, incidents and deletion
Point-in-time recovery is enabled for the database. Development, staging and production are separate, and production data is not used for development. If a personal data breach occurs, we notify affected customers without undue delay, with a target of 48 hours after discovery, so they can meet their own 72-hour duty.
You can export your data at any time as CSV or XLSX, or through the API. After the contract ends you have 30 days to export, after which we delete customer data from production and, once the backup window expires, from backups.
Responsible disclosure
If you believe you have found a security vulnerability, please report it to our security address. Include a description of the issue, the affected URL or component, steps to reproduce, the expected impact and how we can reach you. Screenshots or a short proof of concept help.
We ask for coordinated disclosure: give us reasonable time to investigate and fix the issue before you share it publicly. Please do not access, change or delete data that is not yours, do not degrade the service for others, and stop testing once you have shown the issue.
Frequently asked questions
Where is my data stored?
In the EU. The primary database runs on Supabase on AWS in Ireland. The full list of sub-processors, with location and status, is on our sub-processors page.
Is TimeTracking ISO 27001 or SOC 2 certified?
No, TimeTracking itself does not hold these certifications. Our infrastructure providers publish their own certification reports, and the security measures we apply are described in Annex 2 of our data processing agreement.
Do you offer a data processing agreement?
Yes. The DPA is part of our terms and is accepted with them at sign-up. Our legal documents are being finalised; the current draft is available on the website.
Does TimeTracking track employees' location all the time?
No. TimeTracking does not collect location today. Planned geofence nudges will be optional, set by the employer, and capture a position only at clock events and when entering or leaving a work-site geofence. There is no continuous tracking, no screenshots and no keystroke logging.
Is our data used to train AI models?
No. Customer data is not used to train AI models, and AI features can be switched off for your organisation.
Try TimeTracking free
Free for up to 5 users. Core from €1 per user per month, everything included.