Security
Hours, locations, selfies and bank details are sensitive. This page describes what the product does today.
Every table that holds customer data carries the company's ID and PostgreSQL row-level security is forced on it. Each request runs in a transaction that is scoped to one company, so even a bug in a query cannot return another company's rows.
IBANs (employees' and the employer's) and national ID numbers are encrypted with AES-256-GCM before they are stored. Screens show only the last four digits. The key is kept outside the database.
Inserts, updates and deletes on business records write an audit row with who, when, from where (web, kiosk, assistant…) and the before / after values. The audit table rejects updates and deletes.
The phone's location is read only when a worker taps clock in or clock out. There is no background tracking. Selfies are for manager review: there is no face recognition and no biometric template.
Selfies are stored on our own server, outside the web root, and are only served after a permission check: the worker themselves or a manager allowed to see all timesheets.
Passwords are handled by our authentication library with rate limiting on sign-in. Clock-in and kiosk links carry random tokens; only a hash of each token is stored.
Data sent to the AI model leaves out phone numbers, emails, coordinates and bank details. The assistant cannot change anything on its own: every action waits for a person to confirm it.
A full database backup is taken before every release that could change the database, and the last ten are kept. Scheduled off-site backups are being set up.
The service runs on a dedicated server behind Cloudflare, with all traffic over HTTPS. The application services listen only on the server's private interface.
Free for up to 10 people. No card, no app to install.