Security & Privacy

At BASETIME, we treat your business metrics, logged hours, and invoice data with enterprise-grade security.

We build simple tools, but we never cut corners on data protection.

1. Data Hosting & Infrastructure (EU Only)

EU Data Residency: Our primary databases, application servers and backups are hosted in data centres in the Netherlands, in the European Union. Our sub-processors are listed at https://basetime.pro/data-processing-agreement-dpa/#sub-processors

High Availability: Our hosting provider, DigitalOcean, LLC, operates data centres certified to ISO/IEC 27001, with 24/7 physical security, redundant power supply and DDoS mitigation.

2. Encryption & Data Security

Data in Transit: All traffic between your browser and BASETIME is encrypted using modern TLS 1.3 (HTTPS) protocols.

Infrastructure Security: Access to underlying database infrastructure is strictly restricted via SSH keys, internal VPC networking, and firewall rules. Backups are stored in isolated, access-restricted environments within the EU.

Credential Protection: Passwords are never stored in plain text. We store only salted hashes created with bcrypt.

3. Database Isolation & Backups

Logical Isolation: Customer data is logically separated in a multi-tenant architecture, with database schema-level data separation (dedicated PostgreSQL schema per customer) to prevent one customer from accessing another customer’s records.

Automated Daily Backups: System data is backed up daily within DigitalOcean’s EU datacenter infrastructure to support disaster recovery.

4. Privacy & GDPR Compliance

Strict Confidentiality: We never sell or rent your company data or customer lists.

No Unauthorised AI Training: We do not submit your data, client details or time logs to third-party AI models for training without your instruction.

Data Processing Agreement (DPA): Our Terms include a Data Processing Agreement under Article 28 GDPR.

5. Responsible Disclosure & Security Contacts

Found a potential security vulnerability?
Report it privately to info@basetime.pro.

We will not take legal action against good-faith research that follows these rules: test only accounts you own; do not access, modify or delete other customers’ data; do not degrade or disrupt the service; do not use social engineering; and give us reasonable time to fix the issue before any public disclosure.

Contact our engineering team directly at: info@basetime.pro

This page describes our current security practices for information purposes and may change. Our binding commitments are set out in the Terms of Service and the Data Processing Agreement.