Security and data
Security and data
Your working-time records are evidence: for your employees, their representatives and the Labour Inspectorate. Here is how we keep them safe, where they live and who can see them. The same commitments are binding in our data processing agreement.
Where your data is
- The database is stored and processed only in the European Union.
- A full backup is made every day and kept on our own servers in Spain and in the United Kingdom; the last 14 are kept, and the database provider can also restore any moment of the last 30 days.
- Emails are sent from the EU (Ireland, with France as a fallback).
- Tiemio is run by IncubIQ Solutions Ltd, in the United Kingdom, which the EU recognises as protecting personal data adequately.
Records nobody can rewrite
- Each clock-in, pause and finish is saved with the time our server received it. The phone's time is kept beside it, never instead of it.
- The database itself refuses to change or delete a record. A correction is a new entry saying who asked for it, who approved it, when and why; the original stays.
- Each record is linked to the one before by a cryptographic fingerprint, so a removed or edited record would show.
- Every monthly timesheet is signed, and anyone can check a copy is genuine with its document number.
Who can see what
- You see your own team only. Each employee sees only their own records.
- There are no passwords to steal: people sign in with a one-time code sent to their email. Codes and sessions are stored only as fingerprints, and sessions expire.
- Every request is checked on our server, not just in the app. Sign-in and other sensitive actions are rate-limited, and the website's forms have a bot check.
- Only named IncubIQ administrators can reach the production systems. The AI tools we use to build Tiemio work on the code and test data, never on your data.
What we never collect
- No location: Tiemio does not know where anyone clocks in.
- No fingerprints, faces or other biometric data. A profile photo, if someone adds one, is never used to identify them.
- No advertising or tracking cookies, and we never sell or share data for marketing.
Keeping and leaving
- Records are kept for at least the four years the law requires, also after an employee leaves or you stop using Tiemio.
- You can download every month's timesheet for every employee, as PDF or spreadsheet, at any time.
- After four years, the records stay until you ask us to return or delete them.
- If a security incident affects your data, we tell you within 48 hours, so you can meet your own 72-hour duty.