Security and privacy
The answers your IT head and DPO will ask for.
Where your data lives, who can read it, what is logged and what ClearHours never collects. Each statement below is specific, and the documents behind it are listed.
At a glance
- Customer data
- Stored in Microsoft Azure Central India (Pune)
- Isolation
- Tenant key on every query, PostgreSQL row-level security behind it
- Encryption
- TLS 1.2 or later in transit, Azure encryption at rest
- Audit
- Append-only, every write and every person-level read
- Workforce monitoring excludes
- Screenshots, keystrokes, files, mail contents, camera and microphone
- Assurance
- SOC 2 control mapping in progress
Every line is explained below, with what it covers and what it does not.
Data residency
Customer data is stored in India.
The service keeps customer data in one Azure region in India. The public website and the dashboard’s static files hold none of it.
- Customer data
- Customer data is stored in Microsoft Azure Central India (Pune).
- Static files
- This website and the dashboard’s static files are served from Azure Static Web Apps in East Asia. They hold no customer data.
- Third parties
- Card payments and transactional e-mail go through the sub-processors on our list. Each receives what its service needs, such as billing contacts or e-mail recipients, and never activity data.
- Other regions
- UK, EU and US packs with regional hosting. Planned
Tenant isolation
Two locks between your data and anyone else’s.
Isolation is enforced in the data-access layer and again in the database itself.
- Tenant key
- Every tenant’s rows carry its tenant key.
- Every query
- The data-access layer binds the tenant key on every query.
- Database
- PostgreSQL row-level security is a second line of defence.
- Your data
- Never used to train models, sold or shared across customers.
Encryption
Encrypted on the way and at rest.
Secrets live in a key vault, and credentials the service only needs to check are stored as hashes.
- In transit
- TLS 1.2 or later.
- At rest
- Azure encryption at rest.
- Secrets
- Held in Azure Key Vault. Webhook secrets are encrypted with AES-256-GCM.
- Keys and tokens
- API keys and enrolment tokens are stored only as hashes.
- Agent uploads
- Straight to storage with short-lived, write-only tokens. Device tokens expire after 7 days and renew.
Identity and access
Four roles, enforced on every call.
Roles are checked by the API on every request, not only by hiding menu items.
- Org admin
- Everything in the organisation, and the only role that changes settings.
- Manager
- The people in their own teams.
- Viewer
- Aggregates only, never a named person.
- Employee
- Their own data.
- API keys
- Scopes and expiry, with the secret shown once. Pro plan
- Single sign-on
- Enterprise Preview: enforced SSO, domain verification by DNS and just-in-time provisioning. Not yet verified with a production identity provider. Preview
- SCIM
- Enterprise Preview: SCIM 2.0 users and groups. Not yet verified with a production identity provider. Preview
Audit log
Every look at a person is written down.
An append-only log of every write and every person-level read. Pages about a named person say that the view is logged.
- Append-only
- Rows cannot be edited or deleted. Reading the log is itself logged.
- Export
- Export any period as JSONL or CSV.
- Stream to your SIEM Enterprise plan
- Signed HTTPS batches with delivery history and retry.
Audit log
Wednesday 7 October · every write and every person-level read
JSONL CSV
- 11:42 Priya Manager Opened a timesheet · Asha Read
- 11:40 Priya Manager Opened the presence board · Platform team Read
- 11:31 Rahul Org admin Saved capture policy · Version 8 Write
- 10:58 Rahul Org admin Approved an erasure request · Former employee Write
- 10:12 Meera Employee Downloaded own export · Meera Write
- 09:47 payroll-sync API key Prepared a payroll export · September Write
Rows cannot be edited or deleted. Reading this log is itself logged.
Privacy controls
Privacy rules that hold on every plan.
They are built into the product and hold on every plan. Administrators can tune some of them within fixed limits, and every change is written to the audit log.
- Minimum group size
- 5
- Team figures for smaller groups are withheld. You can set 2 to 100.
- Productivity scores
- 0
- No scores, rankings, alerts about a person or automated decisions.
- India retention floor
- 1 year
- On by default. You set retention from 30 to 3,650 days.
- Grievance respond-by
- 90 days
- Each grievance gets a due date, an owner and a written response.
These workforce-monitoring controls do not describe optional Support or Email Smart. Where those controlled products are enabled, they handle content a customer or mailbox member explicitly provides.
- Told first
- Publish your employee notice from a template and collect acknowledgements in the agent and on the web. The agent is visible, with no stealth mode.
- Minimised on the device
- Window titles in full, as a one-way code or not at all, with redaction rules and application lists applied on the device. Working hours limit application and active or idle time; device status and session events can still be reported outside them.
- Workforce monitoring excludes
- The workforce agent and Companion do not collect screenshots, screen recordings, keystrokes, clipboard, file, mail or message contents, camera, microphone, location or biometrics.
- Retention you set
- Activity data is purged daily past your horizon. Attendance, timesheet periods, work logs and the audit log are kept as records.
- Export and erasure
- Every employee can download their data or ask for erasure. Erasure comes with a proof of what was removed.
- Grievances
- Assignment, a written response and escalation, against a 90-day respond-by date.
Assurance
Where assurance stands today.
Stated plainly, so you can plan your review around it.
Status
SOC 2 control mapping in progress. A penetration-test scope is written; the test itself has not been run yet. ClearHours holds no certification today.
- SOC 2
- Each Trust Services Criterion is being mapped to the control in the code or configuration, with the evidence and the gaps.
- Penetration test
- The written scope puts tenant isolation first, then the API, the dashboard, the Windows agent, the companion app and the Azure configuration, on a test stack with synthetic tenants.
- Not claimed
- No SOC 2 report, ISO/IEC 27001 certificate, uptime figure or public status page exists yet, so none is shown here.
Documents
The documents behind the answers.
Under the DPDP Act 2023 your organisation is the Data Fiduciary and ClearHours is your Data Processor. These documents set out who does what.
-
Under the DPDP Act 2023: roles, safeguards, breach notice, retention and erasure.
-
Who processes customer data, what for, what data and where.
-
DPDP Act 2023 readiness pack
Rules 3, 6, 7, 8 and 14 mapped to the product, with incident records and a data inventory.
On request
-
DPIA template, data inventory and data-flow document
Drafts to start your own assessment from.
On request
-
CERT-In 6-hour incident runbook
How an incident is reported within the CERT-In window.
On request
-
Employee notice templates
India (DPDP), New York, Delaware and Connecticut, the UK and the EU.
In the product
Responsible disclosure
Found a vulnerability? Tell us first.
Write to our security address with the details and the steps to reproduce. Please do not access other customers’ data or degrade the service while testing.
Your review
Ask for the security pack.
The DPDP readiness pack, the DPIA template, the data-flow document and the CERT-In runbook, for your IT head, CISO or DPO.
Already a customer? Sign in