For business customers
Published in English only. Figures on this page are taken from the code that enforces them.
How TimeWarp is built, what protects your data, and what we do not have. Written for the person reviewing us before a purchase.
Every record — focuses, time entries, customers, invoices, business details — is stored under a partition key that is the account's identity from our authentication provider. That identity is taken from a cryptographically verified access token on every request and never from a URL, a request body or a header a caller can set.
This matters more than it sounds. Separation is not a filter applied after a query; there is no query that can reach another account's partition, because the key is not something a request supplies. The same rule holds for requests that arrive through a connected AI assistant: they re-enter the same routes with the same verified identity, and get the same limits.
Your password never reaches us. Sign-in uses SRP, which proves knowledge of the password without transmitting it.
Accounts are held in AWS Cognito with email verification and a minimum password length of ten characters. Sign in with Apple is supported and carries Apple's own two-factor protection.
Connecting an AI assistant uses OAuth 2.1 with PKCE (S256 only), single-use authorization codes, rotating refresh tokens, and audience binding so a token minted for another service cannot be replayed against ours. Reusing a rotated refresh token revokes the whole connection.
Every connection is listed under Settings → Connected apps with when it was made and last used, and can be ended there. Ending it revokes both tokens at once; there is no window in which a disconnected app keeps working.
What a connected assistant can do is deliberately bounded: it cannot read your password, change your plan, or delete your account.
Authentication, password reset, the support form, invoice share links, client registration and the assistant endpoint all sit behind fixed-window rate limits keyed by IP or by account. The limiter fails open on an infrastructure error — a database blip must not lock every customer out of their own account — which is a deliberate trade and worth knowing when you read it here rather than inferring it.
All account and time data is stored on Amazon Web Services in the EU (Frankfurt, eu-central-1) region. There is no other region and no replication outside it.
The full list of sub-processors, what reaches each of them and on what transfer basis, is published at /subprocessors. A connected AI assistant is not on that list, and the reason is explained there.
The two tables holding your records are backed up daily, retained for 10 days, and continuous point-in-time recovery is enabled on them. Backups stay in the same EU region.
Restores are table-level, not per-account: we can recover from an infrastructure failure, but we cannot roll one customer's data back to Tuesday. If you need that, export regularly — the app exports to Excel, CSV or a linked Google Sheet, and the export is yours.
Records are kept until you delete them. Deleting your account removes every row in your partition across both data tables and deletes your identity from the authentication directory; any Google connection is revoked. Backups expire on their own within 10 days.
Short-lived operational records — rate-limit counters, lockout counters, handoff codes, assistant tokens — carry their own expiry and are removed automatically.
TimeWarp is a time tracker, not a case management system, and the safest data is the data you never record. Free-text notes accept whatever you type, so the judgement is yours — but we would rather help you keep it narrow than collect it and protect it.
The macOS capturer is the one place where data can arrive without anyone typing it: it records the active application and window title. It records nothing else — no screenshots, no keystrokes, no page content — and it can be paused at any time, with an exclusion list for applications that should never be captured.
Write to info@sp33c.tech with enough detail to reproduce. We will acknowledge within 3 working days, keep you informed while we fix it, and credit you if you would like that. Please give us a reasonable chance to fix an issue before publishing it. We do not run a paid bounty.
Machine-readable contact details are published at /.well-known/security.txt.
Small vendors are believed in proportion to what they admit, so:
If any of these is a blocker for your organisation, say so early. We would rather lose a deal on the facts than win one on an implication.
Security questions, questionnaires and DPA requests: info@sp33c.tech. See also the Data Processing Addendum and the Privacy Policy.