Security at the center
Read on, Team O'clock data & usage policies
Last modified: Feb 12th, 2023
Online security audits:
Data center
Team O'clock is hosted on Heroku, one of the most well established and trusted PaaS, owned by Salesforce. Our data centers operate on the US region of Amazon Web Services, being accredited under ISO 27001, SOC 1 and SOC 2/SSAE 16/ISAE 3402, PCI Level 1, FISMA Moderate and Sarbanes-Oxley (SOX).
Learn more about Heroku security here.
Data encryption,
in transit and at rest
All internal or external service communications (including third parties, such as Slack, Microsoft Teams or Jira) are encrypted via SSL using TLS1.2+ protocols. Data is encrypted at rest with AES-256, block-level storage encryption.
Data sharing
Data sharing occurs when integrations are enabled. Team O'clock may retrieve user account details (name, email and avatar), only when a user is using the integration. No Team O'clock data is shared with the integrations, unless for updating data on the integration's side, such as standup notes, retrospective action items, and estimations.
Data retention
Application data is retained until the termination of the account. When a Team O'clock organization or user account is deleted, no data is retained. Server logs are retained for 7 days, with all personal data anonymized before storage. Audit logs, used for storing application actions, are retained for a year, with all personal data anonymized before storage.
User authentication
Users are authenticated through Slack, Microsoft or Google social logins, or by using passwordless email authentication. No passwords are stored on our servers. In the case of passwordless authentication, the user is sent an one-off expiring token to the provided email address, that can be used over a very limited amount of time in order to enter the platform.
Single Sign On (SSO)
Per organization SSO is not currently available and can be discussed upon request. However we do support SSO through Slack, Microsoft and Google accounts.
Confidentiality
All employees are restricted by regulations to maintain confidentiality. Access to data is restricted, unless required in order to provide technical support.
Incident management
In the unfortunate event of security breach or unauthorized access to user data, the company will inform you within 72 hours, in compliance with GDPR.
Payments
All payments are processed by our subscription partner Paddle. No credit card information is stored on our servers.