Security and hosting

Hosting and regions

• Each workspace is created in one region (Canada or the United States) and stays there. The region sets its labour-rule defaults and currency, and its data is kept in that region’s own database.
• During early access, both regions’ databases are in Helsinki, Finland, and so are the nightly copies of uploaded files, on that same server’s backup disk. A problem with that data centre can affect both regions.
• EU, UK and Australian regions are planned; the privacy policy lists where each one will be stored.

Encryption

• Everything between your devices and ClockLap travels over HTTPS (TLS).
• In the database, the most sensitive fields are encrypted one by one: phone numbers, pay rates, two-step sign-in keys, and the credentials of the payroll, accounting and calendar systems you connect.
• Uploaded and exported files (punch photos, voice notes, receipts, form attachments, desktop app screenshots and exports) are encrypted with a key for each workspace before they are stored.
• Passwords are stored only as salted hashes; kiosk PINs only as keyed hashes. Nobody at ClockLap can read them.

Keeping workspaces apart

Every table that holds a workspace’s data is protected by the database itself (row-level security): a request working for one workspace can’t read another’s rows, even if the application code had a mistake. Test API keys only reach a separate sandbox copy of the workspace.

Access control

• Roles are scoped to locations, so a site manager sees only their sites. Owners and admins can require two-step sign-in, single sign-on (SAML or OpenID Connect) and automatic provisioning (SCIM).
• API keys and AI assistant connections carry only the scopes you give them, and can be revoked at any time.
• Every change to people, time, pay rules and settings is written to an audit log that can’t be edited.
• Support can only open your workspace while an owner has let them in (for up to 30 days, from Settings → Workspace), and every session is logged with its reason, which you can see. Access is off until an owner turns it on (for 1, 7 or 30 days), they can turn it off at any time, and it ends by itself. Each support session is also recorded in our own staff log, and can’t change anyone’s sign-in details, invite people or create new ways in, such as API keys or webhooks.

Backups

Every database is backed up nightly, each backup is checked by reading it back in full, and backups are kept for 14 days. Uploaded files in Cloudflare R2 are copied nightly to the backup server, still encrypted, and files that were deleted or replaced are kept there for 14 days. During early access the database backups are stored on the same server in Helsinki as the data, not in a second location yet; an off-site copy comes with the move to in-country hosting.

Sub-processors

The service providers that handle data for ClockLap, each bound to use it only to provide their service:

Tools you connect yourself (payroll, accounting, HR, an AI assistant) receive what you choose to send them, under your agreement with them.

Reporting a problem

If you think you’ve found a security problem, email [email protected]. If a breach affects your information, we notify the affected customers and regulators as the law requires.