Reference

Security & privacy

TimerOS is built around two ideas: your workspace’s data stays isolated from every other tenant, and time tracking should never mean surveillance. This page covers the security and privacy controls that ship today — and is honest about what’s still on the way.

Per-workspace data isolation

TimerOS is multi-tenant by design, but your business data is not pooled with anyone else’s. Each workspace gets its own dedicated database for all org data — employees, projects, time entries, payroll, clients, expenses — provisioned when you register. A separate per-tenant database backs the client portal, holding only the subset your clients need. A shared platform database stores just account-level records (tenants, sign-in users, subscriptions, invoices). Tenant identity travels in your signed access token and is verified on every request before any data is read.

Roles and permissions

Access is fine-grained and tier-dependent. Startup workspaces use predefined role presets (Owner, Executive, Management, Team Leader, Team Member); Enterprise (early access) unlocks fully custom roles built on a 228-key permission matrix. Permission checks are enforced server-side, not just hidden in the UI — for example, the classification-rules editor is gated by a specific edit permission, and the client portal scopes every contact login to per-module access (none / view / edit) plus explicit approval flags.

  • Dashboard vs. app roles — website-dashboard roles (Admin / Member) only control dashboard access; Members are redirected to the TimerOS web app. App roles are separate and set inside the apps.
  • Subscription lockout — if a workspace subscription ends, the dashboard and apps hard-lock until it’s reactivated.

See Organization & roles for setting these up.

Two-factor authentication

Per-user TOTP 2FA is available on the desktop app, the web app, the website dashboard, and the client portal. Enroll by scanning a QR code (or entering the secret), verify a 6-digit code, then save single-use backup codes (downloadable once). You can regenerate backup codes or disable 2FA with your password. On the client portal, this self-service enrollment is available to portal-user accounts (the account owner and invited portal users); contacts signed in with the shared client password have their 2FA managed by their account administrator.

  • On the website dashboard, workspace owners/admins can set a 2FA enforcement policy (off, owners & admins, or everyone) from Settings → Authentication.
  • Apply policy now (website dashboard) revokes the sessions of unenrolled users to force immediate enrollment rather than waiting for token expiry.
  • Admins can reset a user’s 2FA from the website dashboard Users table; a persistent banner nudges anyone not yet enrolled. The desktop and web apps have no policy editor — they enforce the policy at sign-in, prompting affected users to enroll before they can continue.

Privacy-first activity tracking

Activity classification runs entirely on your device. A scored rule engine decides first; if it isn’t confident, a small on-device logistic-regression model decides; an employer rule overlay can override both. The output is a simple productive-vs-idle signal.

What never leaves your device
There is no cloud AI, no GPU requirement, no model download, and no LLM. Raw window titles are not sent off the device, and no window title is captured during a declared break. The model trains locally on your own device; your employer’s classification rules are the per-workspace layer, synced from the workspace. The in-app privacy notice cites GDPR Art. 13 and EU AI Act Art. 13.

One optional setting writes to your own disk: Diagnostic recording, in Settings → Activity Detection, keeps a local file of what the classifier saw — raw window titles included — for 30 days, so a tracking problem can be investigated on the machine where it happens. It is off unless you turn it on, only you can turn it on, nothing is transmitted, and turning it off deletes the records. Under every other setting the title is discarded after each check.

Every worker can open Settings → Activity Detection to see the live reason their current window was classified and browse the full baseline and employer rule set read-only. See how classification works and time states.

Real-time updates

Live updates use a single Socket.IO connection per session. The server emits domain-tagged “invalidate” events scoped to your room only, so a staff edit in the desktop app refreshes the portal and dashboard without exposing other tenants’ activity.

AI assistant connections

If you connect an AI assistant such as Claude (see Connect an AI assistant), it acts as you and only within your own permissions, under a scoped token you approve — read, read and write, and optionally your incidents and change requests — that lasts 15 minutes and is refreshed for as long as the connection is in use; a connection unused for 30 days expires. Pay, tax IDs, dates of birth, home addresses and emergency contacts are stripped from every response, and there is no tool that deletes anything.

  • Incidents and change requests sit behind their own consent box, separate from read and read-and-write. It is ticked by default; untick it when you connect and the assistant gets no access to them at all. Anything your clients wrote in one is passed to the assistant marked as data, never as instructions; nothing the assistant writes is published to the client, and no ticket is resolved or closed, without your approval.
  • You receive an email each time a new assistant is connected to your account.
  • Settings → Connections keeps a per-connection activity log — every change the assistant wrote, each with the call that undoes it.
  • Disconnect is one click; access stops on the assistant’s very next request.
  • Workspace owners and admins can turn AI assistant connections off for the whole workspace, which disconnects every live connection immediately and emails the people affected.

Audit logging — in progress

Not yet available
An audit-log backend exists but there is no viewer or export on any surface yet, and the Audit log settings section is a “Coming soon” placeholder. Some notice banners mention an audit log — that record isn’t viewable today. Track progress on the roadmap.

SSO & SAML

Single sign-on (SAML 2.0) is an Enterprise capability that is early access / not yet implemented — the settings section is copy-only. Password sign-in cannot be disabled today. See the roadmap.

GDPR & legal

TimerOS supports compliance workflows: re-consent on updated terms in the apps, and a blocking legal-acceptance gate in the client portal covering both platform terms and your own tenant-authored client notices. Workspace deletion is a soft, cancellable 30-day grace process. For our terms, privacy notice, data-processing details, and monitoring-notice templates, see /legal (including the employee monitoring notice).

Questions
For data-residency, sub-processor, encryption, or DPA specifics not covered here, reach us at support@timeros.ai.