Security & Compliance

This document outlines our commitment to safeguarding the security and privacy of the data you entrust to us. Here, you will find detailed information about how we host and manage our services, our compliance with international security standards, our data protection practices, and the measures we take to ensure the integrity and availability of our systems.

Security Overview

At zeitclaim, we take the security of your data very seriously. We implement industry-standard security measures and continuously monitor our systems to protect your information.

Hosting Infrastructure

Our application components are hosted across multiple services:

• Vercel - Hosts our application and serves our web pages
• Supabase - Manages user authentication and data storage
• OpenAI - Processes AI requests for time management features
• Baseten - Provides AI model hosting via Vercel AI Gateway

Authentication and Access Control

Users can access our Services using secure email/password authentication. We implement:

• Secure password requirements
• Session management with automatic renewal
• Invalid password lockout policy
• Encrypted session tokens

Currently, we do not support Two-Factor Authentication (2FA), but we recommend using strong, unique passwords for your account.

Data Encryption

Data in Transit: All data transmitted between your device and our servers is encrypted using industry-standard SSL/TLS protocols. This applies to all communications, including calendar data, AI interactions, and account information.

Data at Rest: Data stored on our systems is encrypted at rest using industry-standard encryption algorithms provided by our infrastructure partners. Supabase encrypts all data at rest using AES-256 encryption. Data is safeguarded through strong authentication protocols and access controls.

Compliance Certifications

Our servers and infrastructure providers are compliant with major security standards:

Data Storage and Location

Primary Data: User data, calendar events, and time-tracking information are stored in the European Union with Supabase. All data is stored in EU data centers to ensure GDPR compliance.

Backups: Supabase provides automated backups as part of their service to ensure data availability and disaster recovery. Backups are retained according to Supabase's backup retention policies.

Backup and Recovery

Our data recovery strategy includes:

• Automated Backups: Supabase provides automated backups of all user data with point-in-time recovery capabilities
• Disaster Recovery: We rely on Supabase's disaster recovery procedures to restore service in case of incidents. Supabase maintains redundancy to ensure high availability
• Backup Retention: Backups are retained according to Supabase's standard retention policies to ensure data recovery when needed

Data Deletion

When you delete your account or specific data:

• Data is flagged for deletion immediately
• Removed from active systems within 30 days
• Purged from all backups within 90 days

Security Practices

Access Control

Access to live user data is strictly limited to authorized personnel who require it to provide and maintain the Service.

Monitoring and Incident Response

We continuously monitor our systems for potential security threats and have procedures in place to:

• Detect security incidents promptly
• Respond to and mitigate threats
• Notify affected users when required
• Implement improvements to prevent recurrence

System Integrity

We perform automated tests prior to any system update to ensure the integrity of critical functions. Our infrastructure providers maintain redundancy to support service availability and ensure high uptime.

Third-Party Security

All third-party service providers we work with must meet our security standards and are contractually bound to protect your data. We regularly review our service providers' security practices and compliance status.

Your Responsibility

While we implement strong security measures, you also play a crucial role in keeping your data secure:

• Use a strong, unique password for your zeitclaim account
• Never share your password with others
• Log out of your account when using shared devices
• Report any suspicious activity immediately

Reporting Security Issues

If you discover a security vulnerability or have security-related concerns, please report them immediately:

info@zeitclaim.com

We take all security reports seriously and will investigate and address them promptly.

Updates to This Document

We may update this Security & Compliance document as our practices evolve and improve. Material changes will be communicated to users via email or through the Service.