Security & data
How we handle your data — what we do, and what we don’t.
EU-hosted, least-privilege by default, with an audit log on every status change. Below is the actual specification — not a marketing summary.
No credit card · EU-hosted
Infrastructure
Where it lives, how it’s protected.
- Hosting
- EU data centres onlyNo data leaves the EEA except for sub-processor service delivery.
- Encryption · in transit
- TLS 1.3
- Encryption · at rest
- AES-256
- Backups
- Daily, encrypted, EU
- Failover region
- EU secondary
Access control
Least-privilege, enforced at the database.
- Roles
- Admin · Manager · Employee
- Tenant isolation
- Per-organization, row-level enforced
- Manager scope
- Only assigned teams
- Employee scope
- Own hours, shifts and leave
- Audit log
- Every status change records actor + timestamp
Data lifecycle
From export to deletion.
- Background tracking
- None — clock-in/out only
- Analytics
- EU-hosted PostHog (with consent)
- Customer-initiated export
- CSV / PDF — self-serve
- Full export
- On request — within 5 working days
- Deletion after offboarding
- Within 30 days
What we don't do
The shorter list.
- No continuous location tracking outside of clock-in / clock-out
- No selling or sharing data with third parties
- No long-term contracts or hidden fees
- No analytics on individual employee productivity
Get your team on today.
No six-week rollout. Your first employee can clock in today.
€5.99 per user · EU-hosted · cancel monthly