Security

Data protection

• All traffic between the apps and our servers runs over TLS.
• Passwords are stored as one-way hashes and are never recoverable in plain text.
• Sensitive payroll fields are encrypted at rest using a key held outside the database, so a database copy on its own does not expose them.
• Mobile session tokens are stored in the operating system secure store rather than in general application storage.

Access control

• Every record is scoped to a company, and requests are authorised against that scope on the server, so one customer cannot read another customer data.
• Permissions inside a company follow defined roles, so an employee sees their own record while HR and managers see what their role allows.
• Access to production systems is limited to the people who operate the service and is reviewed when someone changes role or leaves.

Attendance integrity

Attendance verification exists because an attendance record is only useful if it can be trusted. Depending on what the employer enables, a punch can be checked against a branch geofence, the branch Wi-Fi network, and a photo taken at the moment of the punch. Each check is recorded with the punch, so an auditor can see how a record was verified rather than taking it on trust.

Infrastructure

• The platform runs on managed cloud infrastructure with automated database backups.
• Application and database credentials are held in environment configuration, not in source control.
• Deployments run through an automated pipeline, so changes reaching production are traceable to a specific commit.

Reporting a vulnerability

If you believe you have found a security issue, email hello@timegate.me with enough detail to reproduce it. We aim to acknowledge within three working days and to keep you updated until the issue is closed.

Please give us a reasonable window to fix an issue before disclosing it publicly, and please do not access, modify or delete data belonging to anyone else while investigating. We will not pursue action against researchers who follow this.