Security & privacy

TimerOS is built on two principles: your workspace’s data is kept separate from every other customer’s, and time tracking should never mean surveillance. Below are the security and privacy controls that work today, and the ones still planned.

Per-workspace data isolation

Your business data is never stored together with another company’s. When you register, your workspace gets its own database for all organisation data: employees, projects, time entries, payroll, clients and expenses. The client portal has a separate database for your workspace, which holds only the data your clients need. A shared platform database stores only account records (workspaces, sign-in users, subscriptions, invoices). On every request, before any data is read, the server identifies your workspace from your signed access token.

Roles and permissions

How finely you can control access depends on your plan. Startup workspaces use ready-made roles (from the owner down to team member; the role names depend on the industry you chose at sign-up). Enterprise (early access) lets you build your own roles with a matrix of 228 permissions. The server enforces these permissions, so hiding a screen in the app is never the only safeguard. For example, only people with a specific edit permission can change classification rules, and each client portal login gets an access level per area (none / view / edit) and separate approval rights.

• Dashboard vs. app roles: website dashboard roles (Admin / Member) only control access to the dashboard; Members are sent to the TimerOS web app. App roles are separate and are set in the apps.
• Subscription lockout: if a workspace subscription ends, the dashboard and apps are locked until it is reactivated.

See Organisation & roles to set these up.

Two-factor authentication

Each user can turn on TOTP two-factor authentication (2FA) in the desktop app, the web app, the website dashboard and the client portal. To set it up, scan a QR code (or enter the secret key), enter a 6-digit code, then save your single-use backup codes (you can download them once). Creating new backup codes or turning 2FA off requires your password. In the client portal, the account owner and invited portal users can set up 2FA themselves. For older portal logins that are not linked to a contact, an administrator manages 2FA.

• On the website dashboard, workspace owners and admins can set a 2FA enforcement policy (off, owners & admins, or everyone) in Settings → Authentication.
• Apply policy now (website dashboard) signs out users who haven’t set up 2FA, so they must set it up right away instead of when their session expires.
• Admins can reset a user’s 2FA in the Users table of the website dashboard. A banner stays visible for anyone who hasn’t set up 2FA yet. The desktop and web apps have no policy editor, but they apply the policy at sign-in: affected users must set up 2FA before they can continue.

Privacy-first activity tracking

Activity classification runs entirely on your device. A rule engine decides first. If it isn’t confident, a small logistic-regression model on your device decides. Rules set by your employer can override both. The result is either productive or idle.

One optional setting saves data on your own computer. Diagnostic recording, in Settings → Activity Detection, keeps a local file of what the classifier saw, including raw window titles, for 30 days. Use it to investigate a tracking problem on the computer where it happens. It is off by default, and only you can turn it on. Nothing is sent anywhere, and turning it off deletes the records. When recording is off, the window title is discarded after each check.

Every worker can open Settings → Activity Detection to see why their current window was classified the way it was, and to view all built-in and employer rules (read-only). See how classification works and time states.

Real-time updates

Live updates use one Socket.IO connection per session. A change your team makes in the desktop app refreshes the portal and dashboard. The server sends these update events only to your own workspace’s channel, so they reveal nothing about other workspaces.

AI assistant connections

If you connect an AI assistant such as Claude (see Connect an AI assistant), it acts as you and only within your own permissions. It uses a token with the access you approve: read, or read and write, and optionally your incidents and change requests. The token lasts 15 minutes and is renewed while the connection is in use. A connection that isn’t used for 30 days expires. Pay, tax IDs, dates of birth, home addresses and emergency contacts are removed from every response, and the assistant has no tool that deletes anything.

• Incidents and change requests have their own consent box, separate from read and read-and-write. It is ticked by default. If you untick it when you connect, the assistant can’t access them at all. Anything your clients wrote in them is passed to the assistant marked as data, never as instructions. Without your approval, nothing the assistant writes is shown to the client, and no ticket is resolved or closed.
• You get an email each time a new assistant is connected to your account.
• Settings → Connections shows an Activity list for each connection: every change the assistant made, each with the call that undoes it.
• Disconnect takes one click, and access stops from the assistant’s next request.
• Workspace owners and admins can turn off AI assistant connections for the whole workspace. This disconnects every connection right away and emails the people affected.

Audit log (in progress)

SSO & SAML

Single sign-on (SAML 2.0) is an Enterprise feature that is in early access and not yet implemented. The SSO section in Settings is text only, with nothing to configure. You can’t turn off password sign-in today. See the roadmap.

GDPR & legal

When our terms change, the apps ask users to accept them again. In the client portal, clients must accept both our platform terms and your own client notices before they continue. Deleting a workspace takes 30 days, and you can cancel it during that time. For our terms, privacy notice, data-processing details and monitoring-notice templates, see /legal (including the employee monitoring notice).