Timetastic Data Security

Here's an overview of Timetastic security:

 

Your data is sent using HTTPS, and encrypted at rest.

When your data is moving between you and us, everything is encrypted and sent securely using HTTPS. We also encrypt your data at rest using Transparent Data Encryption. 

 

We host on Microsoft Azure

Timetastic is hosted on Microsoft Azure cloud platform. This places your data in their European data centres. At the time of writing we use both their UK South and UK West for primary and North Europe (Ireland) for backups.

Using Azure means we take advantage of their rigorous security standards and reliance, servers and firewalls are always up to date. You can read more about their specific standards and procedures here: https://azure.microsoft.com/en-gb/support/trust-center/

 

We don't store your debit/credit card information.

All our payments are processed through Stripe https://stripe.com/gb They are a PCI Service Provider Level 1 organisation - the most stringent certification level available in the payment industry.

Using Stripe means we don't need to store your payment card details, they are sent encrypted direct to Stripe, we don't store them anywhere.

You can read more about security at Stripe here: https://stripe.com/docs/security/stripe

 

Your passwords are hashed

We hash your passwords using a PBKDF2-based function, but that's no reason not to create a strong password in the first instance.

We encourage you to understand, and educate your employees on what makes a strong password, and use them accordingly, maybe test score a password on here https://lowe.github.io/tryzxcvbn/ 

 

Please use 2FA

Passwords get compromised, it's a fact.

We encourage you to setup two-factor authentication in Timetastic to protect your account and data.

It's fairly easy, you just need a smartphone with one of the many authenticator apps installed.

For advanced security we also offer Compulsory 2FA and Single Sign-On.

 

Timetastic employees

We employe a small, tight-knit team at Timetastic. We do full background check before employing and all staff are required to sign confidentiality agreements relating to personal data.

We do not outsource any core development work, and while we do use freelancers for some work, none of them have access to client/ personal data.

 

Keeping your data secure

Keeping customer data safe is a huge responsibility and our top priority. We work hard to protect our customers data from the latest threats. This is not a one time effort, it's a continual process that we monitor and work on.

Security issues come to light through different means and activities, from articles in technical press, discovery during routine work, and through our internal reviews and vulnerability scans.

 

How we deal with security issues

When we discover a security threat we follow this process:

1. Understand the nature of the threat.
2. Assess the risk of the threat to our customers data - bearing in mind the likelihood of breach and the impact of a possible breach.
3. Scope the work required to mitigate or eliminate the risk.
4. Prioritise any work according to the results of this risk assessment.
5. Once the issue is resolved we’ll post an update on our changelog here: 

 

Reporting security problems

Send all security concerns directly to us from the help centre contact form 
We’ll get back to you as soon as we can, usually this will be in 2 hours during week days, but we do check in at weekends too. Feel free to tweet us too https://twitter.com/timetastic