How we keep your team's data safe

Encryption

• In transit: the web app and API are served only over HTTPS (TLS), with HSTS so browsers never fall back to an unencrypted connection.
• Password vault: vault records and their files are encrypted end to end in your browser before they are sent to us, with AES-256 (AES-GCM) and per-record keys shared only with the people and clients given access. Records saved before this was introduced were encrypted with a server-held key; the account owner upgrades them to end-to-end encryption from the vault. Once each upgraded record has been saved and checked, its old server-readable copy, files included, is permanently removed, so afterwards everything in the vault is end-to-end encrypted. Company primary admins keep access to the records in their own company.
• Master password: your vault key is derived from your master password in your browser with Argon2id (64 MiB of memory, 3 passes), which makes guessing it slow and costly even with graphics cards. Vaults set up earlier move to Argon2id automatically at their next unlock.
• Secrets at rest: authenticator-app seeds are stored encrypted (Fernet), and recovery and e-mail sign-in codes are stored only as one-way hashes.
• Files: uploads are stored on Amazon S3 and delivered through Amazon CloudFront.
• Vault password health: the check for weak, reused and missing passwords runs in your browser on records you have unlocked, so the vault stays end-to-end encrypted.

Two-step sign-in

• Sign in to the web app with an authenticator app, a passkey or security key (WebAuthn), or an e-mailed code.
• One-time recovery codes are available if you lose your device.
• Company admins can require two-factor sign-in for their team.

Access groups and permissions

• Role-based access groups control which features each person can see and use. Permissions are enforced on the server, not just hidden in the interface.
• Every company's data is isolated from every other company's.
• Vault records and documents can be shared with specific people at view, edit or full access.
• Public links to published documents can expire after 1, 7 or 30 days and can be protected with a password.
• Every link you send outside your company (public pages, one-time vault links, read-only boards, public forms, invoice and signing links) is a short teamtrackin.com/s/ link with a random code. It never shows your company's address, a title or any ids, and expired or turned-off links simply say they're no longer available.

Audit log

• Changes to key records are logged with who made them and when, including users, companies, projects, tasks, vault records and their sharing, documents access, clients and invoices.
• Vault key material is never written to the log.
• E-signatures come with a signed PDF and an audit certificate, and client approvals in the portal are kept as a permanent record of who decided and when.

Screenshot and tracking privacy controls

• Admins choose, per team member, whether the desktop tracker captures screenshots, URLs, app usage and keyboard and mouse activity. Each can be switched off.

Data retention

• Tracked time, daily summaries, app and website totals and reports are kept for your plan's data history: Basic 2 years, Standard 4 years, Premium and Enterprise 7 years, and the standalone Shift plan 6 years.
• Pay, timesheets, invoices, shift hours, time off, overtime and expense records are kept for 8 years because they are legal and tax records.
• Company admins choose how long screenshots, app and website detail, and location and selfie data are kept, and a nightly job removes data once it passes its period.

AI and your data

• The built-in AI assistant only runs when it is enabled for your company.
• Your data is sent to the model only to answer each request and is not used to train AI models.
• TeamTrackin does not store the prompts or the answers, only how many AI credits each action used.

GDPR and data rights

• People can export their own data and request erasure from within the app; admins can review, complete or reject erasure requests.
• Read more on our GDPR and privacy policy pages.

Sub-processors

These are the services that process data on our behalf.

Third-party integrations such as Jira, Slack, GitHub or QuickBooks only receive data when a customer connects them. AI features only run when they are enabled.

Uptime and contact

Check live service health on our status page. To report a security concern or ask a question, e-mail support@teamtrackin.com.