Last updated 8 November 2026
Security
How eTime protects your workplace's data, built so we need to know as little as possible about your staff.
ID mode: we can't know who your staff are
A workplace can run eTime with aliases only (N-01, N-02 …). eTime then refuses real names, and staff can join with a passkey and no email address. Rule checks, the solver, sick calls, costs and time tracking all work without knowing who anyone is.
Names encrypted
Outside ID mode, names and contact details of staff, clients and guests are encrypted field by field with AES-256-GCM, using a separate data key for each workplace. Those keys are themselves encrypted with a master key held as a Cloudflare secret, never in the database or in code. Your personal calendar and the tokens for linked calendars are encrypted with a key of your own, which no workplace's key can open.
Encrypted everywhere
TLS for every connection, and encryption at rest for everything stored, on Cloudflare's network.
The AI sees aliases only
Before anything goes to an AI model, names are swapped for aliases and contact details and ID numbers are removed. If a known name would still be sent, the request is blocked. Requests go through OpenRouter to Anthropic only, with data collection disabled, and we don't log prompts or answers. The AI phrases and drafts; the rule engine decides what is legal, and a person decides what is applied.
Passwordless sign-in
Passkeys first, with your face, fingerprint or device PIN. As a fallback, a six-digit code or a link by email that lasts 10 minutes, works once and allows five attempts; codes are stored hashed. There are no passwords to steal. Sessions last 12 hours and are renewed while you use eTime. The phone app keeps its sign-in token in the device's Keychain or Keystore.
Access you control
Roles and scopes (owner, admin, scheduler, manager, payroll, employee, representative and others) are checked by the server on every request, not just hidden in the app. Every query is scoped to your workplace. Colleagues see that someone is away, never why, and pay is shown only to people allowed to see it.
Minimal health data
A sick report is a type and dates. eTime never asks for or stores a diagnosis, symptoms or medical certificates, and has no notes field on clients or visits.
No surveillance
No continuous location tracking, productivity scores or screen monitoring. A location check at clock-in reads your position once, after you agree, keeps only inside or outside, and throws the reading away. The kiosk shows a QR code that changes every 30 seconds, so clocking in proves you're at work without reading your location; kiosk PINs and pairing codes are stored hashed.
Quiet notifications
Push notifications say only that something is waiting, such as New shift offer, never a name, a shift or pay. The app fetches the details after you've signed in. Browser push messages are encrypted for your browser, so the push service can't read them.
Audit log
Changes to rosters, people, rules, settings and billing are recorded with who made them and when. Admins can filter and page through the log.
Data in the EU
The database is held in the EU (Cloudflare D1 with EU jurisdiction). Our subprocessors and what each receives are listed on our Subprocessors page.
Protection against abuse
Booking links and sign-in are rate limited, invitations and calendar feed links use secret tokens stored hashed, and eTime runs on Cloudflare's network, with its DDoS protection. Card details go to Stripe and never reach us.
What we don't claim yet
eTime is new. We haven't yet completed an external penetration test or a certification such as SOC 2 or ISO 27001, and eTime isn't offered for use that requires a HIPAA business associate agreement. We'll update this page when that changes.
Privacy by design
No ads, no selling data, no training AI on your data. Export your rosters and time whenever you like.
Reporting a vulnerability
Email security@etime.my with “Security report” in the subject. Include steps to reproduce and the impact. We acknowledge reports within two business days and keep you updated until it's fixed. Please don't access other people's data, degrade the service or publicly disclose before we've had a chance to fix the issue.