Security & data
How we look after your data
Your timesheets and invoices are the record of your business. This page explains, in plain words, where they are and who can reach them.
Where your data lives
- Your account data is stored in a managed PostgreSQL database in Ireland (EU), and the application runs in the Netherlands (EU).
- Our providers and what each one does are listed in our privacy policy and data processing agreement.
- Jurisdiction of our infrastructure (EU Data Act, Article 28): it is located in the European Union and subject to EU and Member State law. Some providers are US companies and may be subject to US law; to prevent international governmental access that would conflict with EU law, we keep data at rest in the EU, encrypt it in transit and at rest, limit and log production access, challenge unlawful requests, and inform the customer concerned unless the law forbids it.
Who can see it
- Every row of data belongs to one company account, and the database itself refuses to show it to anyone outside that account (row-level security), not just our application code.
- Inside your company, members see their own time; managers and admins manage projects, rates and invoices.
- Our team only looks at your data when you ask us to help with something, and never to sell or share it.
How it's protected
- All traffic is encrypted (HTTPS/TLS).
- Sign in with a one-time email link, with Google or Microsoft, or with a password. Passwords are never stored as text: our authentication provider keeps only a salted bcrypt hash, and a forgotten password is replaced through a link sent to your email.
- When you import from Harvest, your token is encrypted while the import runs and deleted as soon as it finishes. We only ever read from Harvest; we never change anything there.
Taking it with you
- Export all your data to CSV or JSON at any time, from your account settings.
- If you close your account, everything in it, including the invoices you issued, is permanently deleted 30 days later. Download your export first.
Questions or a security concern? Write to [email protected]. See also our privacy policy and DPA.