TimeZest uses industry-standard practices to ensure that your data, and the data of your clients is always secure. We have been audited by a third-party specialist auditor, and our security controls comply with the requirements of the AICPA SOC 2 Type I certification. The audit report can be supplied on request.

We don’t publicize all of the security measures we take, but some of the ones we can talk about are listed here.

TimeZest’s servers are hosted (via Heroku) in the Tier 1 data centers of Amazon Web Services (AWS). AWS is an ISO27001-certified hosting provider, with extensive physical, biometric and software access control to the physical servers on which TimeZest runs.

For further information:

Heroku's Security Information

AWS Security Information

All disks used by TimeZest, both for long-term & database storage, as well as temporary data storage are encrypted at rest.

Certain types of particularly sensitive data, such as API keys and OAuth credentials, are stored with an additional level of encryption which prevents their disclosure even in the unlikely event our database is compromised. These credentials are encrypted using industry standard AES-256 encryption.

Our hosting provider provides a secure mechanism for delivering secrets (such as API Keys, encryption keys and client secrets) to the production instances of our application. We do not store any such credentials with the application source code.

TimeZest automatically updates the operating system and application software used on our servers as improvements are made and any security problems are fixed.

Every line of code in the TimeZest application undergoes Static Analysis Security Testing (SAST) with each commit to detect potential security issues.

All code is reviewed by another engineer prior to be merged into our product, and is subject to comprehensive automated unit, functional and integration testing.

We use automated tools to monitor any libraries and software dependencies we use against databases of known security issues and CVE notices.

TimeZest is built using a widely-used application framework which contains in-built support for bound query parameters. Further, our coding guidelines prohibit any direct manipulation of SQL statements as strings.

Our application framework as well as our frontend framework contain automated protection against XSS attacks through automated escaping of any displayed data.

All communication between your browser, our CDN, TimeZest’s servers and the APIs we access are conducted over encrypted protocols such as HTTPS.

TimeZest's environments are automatically and regularly scanned for vulnerabilities using an external commercial vulnerability scanner.

Access to production environments and customer data is strictly limited to a small number of TimeZest employees who require access to it. Our policies prohibit the copying of customer data for any purpose to outside our production environment.

TimeZest uses Multi-Factor Authentication (MFA) for the services we rely on to provide TimeZest to drastically reduce the risk of account compromise and takeover.

2FA for Administrators

TimeZest Administrators can enable 2FA for all users to protect their accounts, and can be required on an organization-wide basis.

TimeZest values the input of independent security researchers in highlighting any vulnerabilities in TimeZest. If you have discovered a potential security vulnerability, we encourage you to report it to [email protected]. TimeZest will respond to your report within 2 business days.

TimeZest does not presently operate a bug bounty program, and unfortunately cannot offer any rewards for vulnerabilities found.
​
Please act responsibly in dealing with your discovery of any identified security vulnerability. Do not take any actions that go beyond what is needed to identify and verify the issue. Please do not use the identified security vulnerability to your own advantage and avoid storing any confidential data obtained as a result of the issue.

Please write us at [email protected].