Security
A short summary of how TimeLeaf protects employee data. The full detail is in our documentation and Data Processing Agreement.
- Encryption
- Data is encrypted at rest with AES-256, and database backups are encrypted. Tax and bank details are also encrypted individually with a key unique to your workspace. All connections use TLS 1.2 or later.
- Hosting
- TimeLeaf runs on Microsoft Azure in the Central US region.
- Backups
- Backups are stored in a geographically separate Azure region for disaster recovery.
- Workspace isolation
- Each workspace has its own database schema and its own file storage, and cannot reach another workspace’s data.
- Access controls
- Single sign-on with Microsoft Entra ID or Google Workspace, passkeys and authenticator apps, an option to require two-factor for admins and owners, and configurable session limits.
- Support access
- Access by TimeLeaf staff is time-limited and every session is logged.
- Sub-processors
- Listed in our Data Processing Agreement, including Microsoft Azure for hosting.
Report a vulnerability
Email [email protected]. We aim to respond within 24 hours and resolve critical issues within 72 hours, and we do not pursue legal action against researchers who follow responsible disclosure.