Security
Security and your data
Where your team’s data lives, who can reach it, how long it’s kept, and what we never do with it.
Where your data lives
Stored in India
Timerfly’s application and database run on our own server in Mumbai. Screenshots are kept in Cloudflare’s object storage.
Encrypted on the way
The website, the web app, the desktop app and the API talk over HTTPS only.
Each company kept apart
Every company’s data is separated inside the database itself, with row-level security, not only by the app: one company’s queries can’t reach another’s rows.
Backed up every night
A copy of the database is made every night and stored off the server as well, so a lost server isn’t lost data.
Who can get in
Passwords never stored
Only a one-way hash of each password is kept. We can’t see your password, and neither can anyone else.
Two-step sign-in
A code from an authenticator app at sign-in, for the web and the desktop app.
Sign in only from the office
On Business, allow sign-in only from your office’s internet addresses.
Sessions you can see
See where your account is signed in and sign out other devices.
Roles
Owners, admins, department managers and employees each see only what their role allows. Employees see their own data.
Our own access, limited and logged
Timerfly support works in a company only when it’s needed to help, for an hour at most, and every change is recorded in that company’s audit log.
How long it’s kept, and what we never do
Screenshots deleted on time
Screenshots are off until a company turns them on, and are deleted automatically after the plan’s period: Starter 45 days, Pro 90 days, Business 6 months.
Your working-time history
Time, apps and attendance are kept while the account is open, so reports stay complete.
Deleted when you leave
When a company closes its account, its data is deleted within 90 days, except records the law requires us to keep, such as invoices.
Never sold
We don’t sell personal data, and activity data and screenshots are never used for advertising.
Payments by Razorpay
Cards, UPI and net banking are handled by Razorpay. We never see or store card numbers or bank passwords.
Your rights
Under India’s Digital Personal Data Protection Act, 2023: to know what’s held, to correct it, and to have it erased. See the privacy policy.
Questions
Where is our data stored?
On Timerfly’s server in Mumbai, India, with a nightly copy of the database stored off that server. Screenshots are kept in Cloudflare’s object storage.
Can other companies on Timerfly see our data?
No. Each company is separated in the database itself, and every request is limited to the company it belongs to.
Can Timerfly staff see our data?
Only when needed to run the service, fix a problem or answer your request. A support visit lasts an hour at most and every change it makes is in your audit log.
Does the app record keystrokes?
No. It only notices whether the keyboard or mouse was used, to tell working from idle. What it records and never records, for your team, is on the For employees page.
How do we report a security issue?
Email support@timerfly.com. We fix anything confirmed as a priority.
More detail
What the app records for your team: For employees. Everything we collect and why: Privacy policy. Whether Timerfly is up right now: System status. Anything else: support@timerfly.com.