Security at TimeNova.

The most important control: data we never collect

TimeNova has no keylogging anywhere in the product. The tracker never requests input-monitoring permissions, so keystroke content is not captured, not stored, and cannot leak, because it does not exist. URL query strings are stripped at the moment of ingestion, before storage, apart from the one part that names the page on a few sites (the words of a web search, a YouTube video id, a SharePoint document id), so session tokens and password-reset links never persist on our side.

How data is protected

• Isolation per company. Every read and write in the system is scoped to your account at a single enforced layer; cross-account access is refused structurally, and role permissions (owner, admin, manager, member) narrow within the account.
• Encrypted transport. All traffic between trackers, browsers and our servers runs over TLS. Agents authenticate with write-only credentials that cannot read any data back.
• Screenshots and recordings. Media lives in cloud object storage under per-company keys and is served only through short-lived signed URLs to authenticated sessions of the right account. Blur, when enabled, is applied on the person's machine before upload; a frame that cannot be blurred is not uploaded.
• Retention is deliberate. Raw capture is kept per your plan's stated retention and then deleted, media bytes before database rows. Deleting a person erases their samples, screenshots and recordings, verified down to the stored objects.
• Uptime, in public. An independent monitor checks the dashboard from outside every few minutes, and the result, including past incidents, is published at status.timenova.ai.
• An audit log that cannot be edited. Every consequential admin change, capture settings, roles, privacy switches, is written to an activity log with no edit or delete route, and it survives the deletion of the person it mentions.

Certifications and reporting

TimeNova does not currently hold SOC 2 or ISO 27001 certification. Our current control environment is documented above and in the Data Processing Agreement, and we respond to security questionnaires in writing. This page is updated as our certification position changes.

To report a security concern, contact team@timenova.ai. Reports are acknowledged the same business day and handled by the engineering team directly.

For a procurement or security review

The documentation a vendor assessment requires is published rather than provided on request.

• Data Processing Agreement. Executed and returned within two business days, on any plan including a trial, at no cost. Customer templates are accepted. The same page sets out controller and processor roles, categories of data processed, retention, deletion, international transfers and breach notification.
• Sub-processors. Every third party with access to customer data, its function, and the scope of data available to it. The list is updated in advance of any addition, and account owners are notified.
• Data residency. The hosting region for your account's database and media storage is confirmed in writing on request, specific to your account.
• Certification status. Stated explicitly in the section above, and kept current.