Trust center
Your team's data, in safe hands.
Hourtick holds your hours, clients, invoices and conversations. Here's where that data lives, who can reach it, how it's protected, and what we haven't done yet.
At a glance
Checked
Stored in the EU
Servers and database in Frankfurt, Germany
Encrypted in transit
TLS on every connection, end to end
Daily off-site backups
With a second provider in Amsterdam, kept 30 days
GDPR and a DPA
Part of our terms, so there's nothing to sign
Two-factor on production
Every account that can reach our servers
Breach notice
Without undue delay, aiming for 48 hours
Where your data lives
From your screen to the backup, in the EU.
This is the path your data takes. Everything Hourtick stores sits in the European Union, and every step on the way there is encrypted.
- Step 1
You
Web, Mac, iPhone, Android
Everything you send is encrypted with TLS.
- Step 2
Cloudflare
Global network
Stops attacks and bots before they reach us.
- Step 3
Hourtick servers
Frankfurt, Germany
Akamai Cloud. Only accept traffic from Cloudflare.
Inside the EU. - Step 4
Database
Frankfurt, Germany
Not reachable from the internet at all.
Inside the EU. - Step 5
Backups
Amsterdam, Netherlands
Backblaze, a second provider. Daily, kept 30 days.
Inside the EU.
Alongside:
FilesFrankfurt, or the US if your admin chooses
EmailMailgun, EU region
ErrorsSentry, Frankfurt, from 18 Nov 2026
Security
Protected at every layer.
A summary of each area. The Security page has every control, in detail.
Infrastructure and hosting
Hourtick runs on Akamai Cloud (Linode), Frankfurt, Germany. Cloudflare sits in front of it, and the servers only accept traffic that comes through Cloudflare.
5 controls
Encryption
Everything between you and Hourtick is encrypted. Credentials we have to keep are encrypted or hashed, so a copy of the database doesn't give them away.
5 controls
Accounts and sign-in
Sign in with Google, Microsoft, Apple, your company's SAML single sign-on, a magic link or a password with two-factor authentication. Each method is built so that a stolen link or code is useless on its own.
9 controls
Permissions and workspace isolation
What you can see is decided on the server, on every request. Hiding a button is never the only thing standing between someone and your data.
4 controls
AI agents
AI agents are teammates with limits. They never get more access than an ordinary member, and your organisation decides which AI provider runs them.
7 controls
Backups and recovery
The database is backed up every day to a separate provider in another country, so one data centre, one provider or one mistake can't take your data with it.
3 controls
Secure development
Every change to the code is tested automatically, and the code is reviewed for security as a whole, not just change by change.
6 controls
Who can access production
Access to servers and the database is limited to a small team, and every account that can reach production is protected by two-factor authentication.
3 controls
Our commitments
What we promise about your data.
Your data is yours
Export your time and expenses whenever you like, and delete your account yourself. What's in your workspace is processed only to run Hourtick for you.
We don't sell it
Your data is never sold or shared with advertisers. Only the subprocessors we list get access, and only to do their job for us.
No AI training on your data
Hourtick doesn't run or train AI models. The agents you connect run with the provider your organisation chooses.
No surveillance
No screenshots, no keystroke logging, no app or location tracking. A timer runs because you started it.
30 days' notice of changes
Before a new subprocessor starts handling your data, we update the list and email every workspace owner, at least 30 days ahead.
Straight answers when it matters
If a breach affects your data, we tell you without undue delay, aiming for 48 hours, with what we know at the time.
Subprocessors
Who helps us run Hourtick.
Every company that processes data for us, what for, and where. New ones are announced to workspace owners 30 days ahead.
| Provider | What for | Where |
|---|---|---|
| Akamai Cloud | Servers, database and file storage | EU |
| Backblaze | Database backups | EU |
| Cloudflare | Encrypted delivery and attack protection | Global |
| Mailgun | Email delivery | EU |
| SentryFrom 18 November | Error monitoring | EU |
| Stripe | Payments and invoicing | Global |
| Optional sign-in, Android push | Global | |
| Apple | Optional sign-in, iPhone push | Global |
| Microsoft | Optional sign-in | Global |
| Google Analytics and Ads | Website analytics and ad measurement, with consent | Global |
Documents
Everything in writing.
Our policies and agreements, in plain language. The DPA applies automatically as part of our terms.
Data processing agreement
Hourtick's GDPR Article 28 data processing agreement for customer workspaces: scope and roles, details of processing, and our obligations as processor.
Privacy policy
How Hourtick collects, uses, shares and protects personal data, how long we keep it, and your rights under the GDPR, including access and deletion.
Subprocessors
The third parties that process personal data on behalf of Hourtick, what each one does for us, and how we tell you about changes to the list.
Security
How Hourtick protects your data: EU hosting, encryption, access control, AI agent limits, daily off-site backups, secure development and responsible disclosure.
Terms of service
The agreement between you and Hourtick for using the Hourtick website, apps, API and MCP server: accounts, plans and payment, and your responsibilities.
Cookie policy
The cookies and local storage Hourtick uses: what's necessary, and Google Analytics and ad measurement (Google Ads) only if you allow them.
Acceptable use policy
What you may not do with Hourtick, whether you use the website, the apps, the API, the MCP server or AI agents, and how we enforce these rules.
Accessibility statement
Hourtick's commitment to accessibility: the website targets WCAG 2.2 Level AA, how we test it, known limitations, and how to report a barrier.
FAQ
Questions buyers ask us.
Where is my data stored?
In the EU. Hourtick's servers and database run in Frankfurt, Germany, and the daily backups are stored in Amsterdam, the Netherlands. Uploaded files are stored in Frankfurt too, unless your workspace admin chooses US file storage before the first upload.
Is Hourtick ready for GDPR?
Yes. Your data is hosted in the EU, our Data Processing Agreement is part of the Terms of service, the subprocessor list is public with 30 days' notice of changes, and you can export or delete your data yourself.
Do we need to sign a DPA?
No. The Data Processing Agreement forms part of the Terms of service, so it applies from the moment your workspace is created. You can read it at hourtick.com/dpa.
Are you SOC 2 or ISO 27001 certified?
Not yet. Rather than a report, we'll answer your security questionnaire in full. Send it through the form on this page.
Do you support two-factor authentication and single sign-on?
Yes. Anyone who signs in with a password can turn on two-factor authentication with an authenticator app in Settings. Workspace admins can connect Okta, Microsoft Entra ID, Google Workspace or any SAML 2.0 identity provider, and then require single sign-on for their email domain. Both are included for everyone, at no extra cost.
Can an AI agent see everything in our workspace?
No. An agent never has more than member rights. It can be made read-only and limited to chosen clients and projects, and it only reads a private conversation for the people in it.
Do you use our data to train AI?
No. Hourtick doesn't run or train AI models. Agents your organisation connects run with the AI provider it chooses, under its own agreement with that provider.
What happens to our data if we leave?
Export what you need as CSV, then delete your account or workspace in Settings. A workspace you're the only member of is deleted with everything in it at once, and backups roll over within 30 days.
How do I report a security issue?
Use the contact form with the topic “Security question or report”. Please give us reasonable time to fix it before you disclose it. We won't take legal action against good-faith research.
Doing a vendor review?
Send us your security questionnaire.
Paste your questions, or tell us where to find your form, and a person who knows Hourtick's security will answer every one in writing. Security issues go here too.