Security

TimeHunter security — GDPR compliant, audit log, EU data

EU data, passwords stored only as bcrypt hashes, account lockout after failed logins, an audit log and a data processing agreement. Here is exactly how we protect your company’s data.

Data processing agreementTry 14 days free

Data exclusively in the European Union

All your company data — sessions, employee PII, leave requests, documents — is stored only on EU servers. Primary region: Frankfurt (DE), backup: Warsaw (PL). No US transfers, no Cloud Act, no Schrems II surprises.

Technical safeguards

HTTPS connection

All traffic between the browser, the mobile apps and the server is encrypted (TLS).

Passwords hashed with bcrypt

We never store passwords in plain text, only their bcrypt hash. API keys are stored as SHA-256 hashes.

Company data isolation and roles

Every query is scoped to your company’s data, and each user sees only what their role allows (admin, manager, employee).

Login protection

After 5 wrong passwords the account is locked for 15 minutes, and login attempts per IP address are rate-limited. The session is kept in an httpOnly cookie.

Audit log

Logins, working-time corrections, request decisions and month closings are logged with the author, time, IP address and before/after values.

GDPR compliance

TimeHunter is GDPR-compliant by design. In the admin panel: employee data export (art. 15) and anonymisation of an employee’s data on request (art. 17). The data processing agreement (art. 28) is concluded when you accept the Terms, and its full text is on the DPA page.

Frequently asked questions

Can I get a DPA to sign?
The data processing agreement (GDPR art. 28) is concluded when you accept the Terms, and its text is on the DPA page. We send a PDF version on request.
What happens to data after contract termination?
Data is kept for 30 days (you can restore the account), then deleted from the active databases. Backups are deleted within a further 90 days. The DPA describes the details, including audit-log retention.
What is the password policy?
When creating a company account, changing or resetting a password we require at least 12 characters, including an upper-case letter, a lower-case letter and a digit. After 5 failed login attempts the account is locked for 15 minutes.
Can I see who corrected working time?
Yes. The audit log in the admin panel records logins, edits and deletions of work sessions, request decisions, month closings and data exports or anonymisations — with the author, time, IP address and before/after values.

Try 14 days free

Start a 14-day trial. No card required, full functionality.

Try 14 days freeSee pricing

Related pages

API & integrations

This website uses cookies

We use cookies to ensure proper functioning of the service, analyze traffic and personalize content. Learn more in our Privacy Policy