Security
How we protect your data
Everything we do to keep your hours, clients, invoices and conversations safe, written out in plain words. Every line describes something Hourtick does today.
Last reviewed 14 areas, 59 controlsTrust center
In short
- Hosted in the EU, in Frankfurt
- Encrypted on every connection
- Daily backups to a second provider
- AI agents capped at member rights
- 2FA on every production account
On this page
Infrastructure and hosting
Hourtick runs on Akamai Cloud (Linode), Frankfurt, Germany. Cloudflare sits in front of it, and the servers only accept traffic that comes through Cloudflare.
Your workspace data is stored in the EU
Application servers and the PostgreSQL database run in Frankfurt, Germany. Uploaded files are stored there too, unless a workspace admin chooses US file storage before the first upload.
The origin only talks to Cloudflare
Cloudflare presents a client certificate on every request (Authenticated Origin Pulls), and our servers refuse connections without it. Nobody can reach them directly and skip Cloudflare's protection.
The database isn't on the internet
PostgreSQL listens only on the server itself. Its port, like the application port, is closed to the outside world.
Protection against attacks and bots
Cloudflare absorbs attacks at the edge. Sign-up, password reset and the contact form use bot checks (Turnstile).
Rate limits on sign-in and sign-up
Sign-in, sign-up, password reset and magic links are rate-limited, and limits are stored in the database so they hold across server restarts.
Encryption
Everything between you and Hourtick is encrypted. Credentials we have to keep are encrypted or hashed, so a copy of the database doesn't give them away.
TLS on every connection
From your browser or app to Cloudflare, and from Cloudflare to our servers (Full strict, with a verified certificate). HSTS tells browsers never to use plain HTTP.
Passwords are never stored
Only salted scrypt hashes, which are slow to guess by design.
Tokens are stored as hashes
API tokens, agent keys, app sign-in codes, OAuth tokens and share links are stored as SHA-256 hashes and compared in constant time. A token is shown once, when it's made.
Connected-app secrets are encrypted
Tokens for integrations you connect, your AI providers' admin keys and chat webhook addresses are encrypted with AES-256-GCM before they're saved.
Files stay private
Storage buckets are private. A file opens through a signed link that expires after minutes, and HTML and SVG files always download instead of opening in the page.
Accounts and sign-in
Sign in with Google, Microsoft, Apple, your company's SAML single sign-on, a magic link or a password with two-factor authentication. Each method is built so that a stolen link or code is useless on its own.
Sign in with Google, Microsoft or Apple
Their two-factor authentication then protects your Hourtick account too.
Two-factor authentication for passwords
Anyone who signs in with a password can turn on a code from an authenticator app in Settings, with ten one-time backup codes. Both are stored encrypted, ten wrong codes in a row pause the second step for 15 minutes, and email links are refused for these accounts so a mailbox alone never gets past it.
Single sign-on with SAML
Workspace admins connect Okta, Microsoft Entra ID, Google Workspace or any SAML 2.0 identity provider. The email domain is proven with a DNS record, responses must be signed and are accepted once, and only addresses on that domain get in. New people join the workspace on their first sign-in.
Require single sign-on
Once SSO works, admins can make it the only way in for their domain: passwords, email links and Google, Microsoft or Apple sign-in stop working for those addresses. Workspace owners keep a way in, in case the identity provider is down.
Magic links and reset links work once
They expire quickly, are stored hashed, and a password reset signs out every other session and emails you.
Sessions are locked to the browser
Session cookies are HttpOnly and SameSite=Lax, so scripts can't read them and other sites can't send them.
Apps sign in through your browser
The Mac app uses a single-use, two-minute code delivered to your own machine (RFC 8252). The phone apps use PKCE (RFC 7636), and Sign in with Apple uses a signed identity token with a one-time nonce.
Sessions on your phone stay in its secure storage
The iOS Keychain on iPhone and the Android Keystore on Android.
MCP and OAuth done strictly
Hourtick's OAuth server requires PKCE (S256) and exact redirect addresses. Codes work once, and refresh tokens rotate with reuse detection.
Permissions and workspace isolation
What you can see is decided on the server, on every request. Hiding a button is never the only thing standing between someone and your data.
Roles enforced on the server
Owner, admin, manager, member and guest. Every request checks that you still belong to the workspace and what your role allows, inside the database query itself.
Workspaces are kept apart
Everything fetched by id is scoped to its workspace. Private channels and direct messages are only visible to the people in them.
Guests see only what they're given
A client or outside guest sees only their own projects, their tasks, notes and files, and chats only with their contacts. No reports, rates, costs, agents or API access.
Input is checked before it's used
Request bodies are validated against strict schemas, so nobody can slip in fields they shouldn't set, like their own role.
AI agents
AI agents are teammates with limits. They never get more access than an ordinary member, and your organisation decides which AI provider runs them.
Never more than a member
An agent is capped at member rights, can be limited to read-only, and can be scoped to chosen clients and projects. Outside its scope, things simply don't exist for it.
An agent acts as itself
Reports, timers and search show the agent's own work, not its owner's, so nobody can read someone's private data by asking their agent.
Private conversations stay private
An agent reads a private conversation only for the people in it.
Prompt-injection defences
Text from other people reaches an agent inside a clearly marked fence, separated from its instructions.
Limits on delegation
Agents asking agents is checked for depth and loops, and limited per hour, so a runaway chain can't flood your workspace.
Webhooks can't reach our network
Agent webhooks connect through a guard that checks the real address and blocks internal and reserved networks, and they never follow redirects.
We don't train AI on your data
Hourtick doesn't run or train AI models. Your organisation runs its agents with the provider it chooses, under its own agreement.
Data integrity and audit trail
Time data is what you bill from, so Hourtick keeps a record of every change and locks what has been approved or invoiced.
Every change to time is recorded
An append-only log keeps what changed, from what, to what, by whom and when. Admins can read it in the app, as CSV and through the API.
Approved and invoiced time is locked
On the server, so not even a phone replaying old offline edits can change it.
The approval trail survives a reopen
Submitting, approving and reopening a week are all kept in its history.
No lost updates
The same rules check every change on your device and on the server, the database allows one running timer per person, and versioning stops two edits from overwriting each other.
Backups and recovery
The database is backed up every day to a separate provider in another country, so one data centre, one provider or one mistake can't take your data with it.
Daily backups, off-site
Every day, the database is backed up to Backblaze B2 in Amsterdam, a different provider and a different data centre from the servers in Frankfurt. Both are in the EU.
Kept for 30 days
Backups roll over after 30 days, so data you delete is gone from them within a month, as our privacy policy says.
Deleted time can be restored
A deleted time entry stays restorable until the workspace itself is deleted.
Monitoring
We watch for problems so we can fix them before you notice, and we collect as little as an error needs.
Error monitoring in the EU, from 18 November 2026
Errors in the web app are reported to Sentry in its EU region (Frankfurt), without session recordings or request bodies.
Server logs kept for 30 days
Unless they're needed to investigate a specific security incident.
Secure development
Every change to the code is tested automatically, and the code is reviewed for security as a whole, not just change by change.
Every change is tested
Every change to the code runs type checks, unit tests, migration and schema checks, a production build and end-to-end tests against a real database.
The main branch is protected
Branch protection on the code that deploys to production.
Dependencies are watched
Security alerts on our dependencies are triaged as they arrive, and build tools from third parties are pinned to exact versions.
No secrets in the code
Keys and passwords live only in the production environment. Our full git history has been checked: no secret has ever been committed.
Whole-codebase security reviews
The latest, on 15 October 2026, covered the web app, API, MCP server, agents, payments, integrations, the apps and the infrastructure. The most serious findings were fixed within days.
Safe by construction
No raw SQL built from input, rich text rendered with safe link schemes only, notes sanitised on the server, and spreadsheet formulas neutralised in CSV exports.
Who can access production
Access to servers and the database is limited to a small team, and every account that can reach production is protected by two-factor authentication.
A small team
Only the people who run Hourtick can reach the servers, the database or the hosting accounts.
Two-factor authentication everywhere
On every operator account that can reach production: hosting, DNS and network, deployment and source code.
Admin tools check themselves
Every admin page and action verifies the admin's confirmed identity on its own, not just the page around it.
Payments
Card details never touch Hourtick's servers.
Stripe handles cards
Stripe is certified PCI DSS Level 1. Hourtick never sees or stores card numbers.
Amounts are worked out on our server
Not in your browser, and every payment call is idempotent, so a retry can't charge twice.
Payment events are verified
Every Stripe webhook is checked against its signature, and subscriptions are read back from Stripe before we act on them.
Apps and updates
The apps you install are signed, and so are their updates.
Signed and notarized Mac apps
Signed by WeCode A/S and notarized by Apple.
Signed updates
Mac app updates are verified with a signature before they install, and phone app updates are code-signed.
No hidden browsers
The phone apps don't load web pages inside themselves, and allow no exceptions to the operating system's secure-connection rules.
Privacy by design
Hourtick tracks time because you start a timer, not by watching you.
No surveillance
No screenshots, keystroke logging, app or website tracking, or location tracking. The Mac app only reads the system's idle time, to offer idle detection while a timer runs.
No analytics or advertising cookies in the app
Google Analytics and Google Ads measurement run only on our public website, with the visitor's consent in the EU, the EEA, the UK and Switzerland, and until they switch them off elsewhere.
You own your data
Export your time and expenses as CSV whenever you like, and delete your account yourself in Settings.
Incidents
If something goes wrong with your data, you hear it from us, quickly and plainly.
Notice within 48 hours
Our DPA commits us to tell you without undue delay, aiming for 48 hours, after we become aware of a breach affecting your data, with what we know at the time.
Tell us what you see
If something looks wrong with your account or your data, write to us with the topic “Security question or report”. It goes straight to the people who can act on it.
Report a vulnerability
Found a security issue? Tell us through the contact form, with the topic “Security question or report”, and include the details and steps to reproduce it.
Please give us reasonable time to fix it before you disclose it, and don't access data that isn't yours. We won't take legal action against good-faith research that follows these rules.
Security question or report
It goes straight to the people who run Hourtick. The topic is already chosen.