Reference

Security & privacy

TimerOS is built around two ideas: your workspace’s data stays isolated from every other tenant, and time tracking should never mean surveillance. This page covers the security and privacy controls that ship today — and is honest about what’s still on the way.

Per-workspace data isolation

TimerOS is multi-tenant by design, but your business data is not pooled with anyone else’s. Each workspace gets its own dedicated database for all org data — employees, projects, time entries, payroll, clients, expenses — provisioned when you register. A separate per-tenant database backs the client portal, holding only the subset your clients need. A shared platform database stores just account-level records (tenants, sign-in users, subscriptions, invoices). Tenant identity travels in your signed access token and is verified on every request before any data is read.

Roles and permissions

Access is fine-grained and tier-dependent. Startup workspaces use predefined role presets (Owner, Executive, Management, Team Leader, Team Member); Enterprise (early access) unlocks fully custom roles built on a 228-key permission matrix. Permission checks are enforced server-side, not just hidden in the UI — for example, the classification-rules editor is gated by a specific edit permission, and the client portal scopes every contact login to per-module access (none / view / edit) plus explicit approval flags.

  • Dashboard vs. app roles — website-dashboard roles (Admin / Member) only control dashboard access; Members are redirected to the TimerOS web app. App roles are separate and set inside the apps.
  • Subscription lockout — if a workspace subscription ends, the dashboard and apps hard-lock until it’s reactivated.

See Organization & roles for setting these up.

Two-factor authentication

Per-user TOTP 2FA is available on the desktop app, the web app, the website dashboard, and the client portal. Enroll by scanning a QR code (or entering the secret), verify a 6-digit code, then save single-use backup codes (downloadable once). You can regenerate backup codes or disable 2FA with your password. On the client portal, this self-service enrollment is available to portal-user accounts (the account owner and invited portal users); contacts signed in with the shared client password have their 2FA managed by their account administrator.

  • On the website dashboard, workspace owners/admins can set a 2FA enforcement policy (off, owners & admins, or everyone) from Settings → Authentication.
  • Apply policy now (website dashboard) revokes the sessions of unenrolled users to force immediate enrollment rather than waiting for token expiry.
  • Admins can reset a user’s 2FA from the website dashboard Users table; a persistent banner nudges anyone not yet enrolled. The desktop and web apps have no policy editor — they enforce the policy at sign-in, prompting affected users to enroll before they can continue.

Privacy-first activity tracking

Activity classification runs entirely on your device. A scored rule engine decides first; if it isn’t confident, a small on-device logistic-regression model decides; an employer rule overlay can override both. The output is a simple productive-vs-idle signal.

What never leaves your device
There is no cloud AI, no GPU requirement, no model download, and no LLM. Raw window titles are not sent off the device, and no window title is captured during a declared break. The model trains locally on your own device; your employer’s classification rules are the per-workspace layer, synced from the workspace. The in-app privacy notice cites GDPR Art. 13 and EU AI Act Art. 13.

Every worker can open Settings → Activity Detection to see the live reason their current window was classified and browse the full baseline and employer rule set read-only. See how classification works and time states.

Real-time updates

Live updates use a single Socket.IO connection per session. The server emits domain-tagged “invalidate” events scoped to your room only, so a staff edit in the desktop app refreshes the portal and dashboard without exposing other tenants’ activity.

Audit logging — in progress

Not yet available
An audit-log backend exists but there is no viewer or export on any surface yet, and the Audit log settings section is a “Coming soon” placeholder. Some notice banners mention an audit log — that record isn’t viewable today. Track progress on the roadmap.

SSO & SAML

Single sign-on (SAML 2.0) is an Enterprise capability that is early access / not yet implemented — the settings section is copy-only. Password sign-in cannot be disabled today. See the roadmap.

GDPR & legal

TimerOS supports compliance workflows: re-consent on updated terms in the apps, and a blocking legal-acceptance gate in the client portal covering both platform terms and your own tenant-authored client notices. Workspace deletion is a soft, cancellable 30-day grace process. For our terms, privacy notice, data-processing details, and monitoring-notice templates, see /legal (including the employee monitoring notice).

Questions
For data-residency, sub-processor, encryption, or DPA specifics not covered here, reach us at [email protected].