Last modified: May 28th, 2024

Data center

Team O'clock is hosted on, a PaaS owned by Render Services, Inc. Our data centers operate on the Europe (Frankfurt) region of Amazon Web Services, being accredited under ISO 27001, SOC 1 and SOC 2/SSAE 16/ISAE 3402, PCI Level 1, FISMA Moderate and Sarbanes-Oxley (SOX).

Learn more about Render's security here.

Data encryption,
in transit and at rest

All internal or external service communications (including third parties, such as Slack, Microsoft Teams or Jira) are encrypted via SSL using TLS1.2+ protocols. Data is encrypted at rest with AES-256, block-level storage encryption.

Data sharing

Data sharing occurs when integrations are enabled. Team O'clock may retrieve user account details (name, email and avatar), only when a user is using the integration. No Team O'clock data is shared with the integrations, unless for updating data on the integration's side, such as standup notes, retrospective action items, and estimations.

Data retention

Application data is retained until the termination of the account. When a Team O'clock organization or user account is deleted, no data is retained. Server logs are retained for 7 days, with all personal data anonymized before storage. Audit logs, used for storing application actions, are retained for a year, with all personal data anonymized before storage.

User authentication

Users are authenticated through Slack, Microsoft or Google social logins, or by using passwordless email authentication. No passwords are stored on our servers. In the case of passwordless authentication, the user is sent an one-off expiring token to the provided email address, that can be used over a very limited amount of time in order to enter the platform.

Single Sign On (SSO)

Per organization SSO is supported using SAML 2.0, such as Okta. Additional SSO options include authentication through Slack, Microsoft and Google accounts.


All employees are restricted by regulations to maintain confidentiality. Access to data is restricted, unless required in order to provide technical support.

Incident management

In the unfortunate event of security breach or unauthorized access to user data, the company will inform you within 72 hours, in compliance with GDPR.


All payments are processed by our subscription partner Paddle. No credit card information is stored on our servers.

🙏 Special thanks to:

for helping us identify issues with our service.