Trust & Security
Gain full visibility into our continuously monitored security controls and policies. Request access to our security documents and learn how we protect your data in our Trust Center.
ClickTime's legacy of trust
Since our founding in 1999, ClickTime has thrived as a management-owned company, free of outside investors or debt. This independence allows us to serve our customers and no one else. Below, you’ll find comprehensive details on how we protect your data, ensure privacy, maintain robust compliance, and achieve consistent uptime. Our promise is to safeguard your information as if it were our own, never compromising or trading on your trust.
Application security
Our focus on application security from development through deployment ensures that our software remains robust, resistant to unauthorized access, and trustworthy.
Penetration testing
ClickTime engages an independent third-party expert to conduct annual penetration testing. This in-depth evaluation of our production architecture enables us to identify and address potential vulnerabilities.
Bug bounty program
Our Security Reward Program invites security experts worldwide to continuously probe our platform for vulnerabilities. Proactively identifying security gaps helps us reinforce the integrity and safety of our services.
SDLC
Security practices are built into our platform’s planning, development, and release processes, especially to logically and physically separate production and non-production environments.
AI
We do not share or sell your information, and we maintain robust data integrity and security measures, including encryption and access controls, to ensure your information is protected and confidential.
Data security policies
Our commitment is to handle your data as if it were our own.
Datacenter Physical Security
ClickTime’s data center is housed at a Tier 1 colocation facility. Advanced entry security, fire protection, and extensive backup power generation are provided at this facility. All access to the datacenter is controlled 24/7 by security guards and video surveillance. Additionally, our facility has been given SOC2 certification.
Data Security
The ClickTime servers reside behind industry-standard firewalls and security appliances. Only our customer-facing web servers have any ports exposed to the public Internet; all database systems are invisible to the outside world. All servers are monitored around the clock by three redundant systems. An alert is generated at any sign of intrusion, denial-of-service, or service outage, and any significant events trigger automated calls to personnel on-call 24x7x365. All web servers and sites have 2048-bit SSL certificates issued by Network Solutions, verifiable by customers at any time.
Load-Balancing & Redundancy
ClickTime’s public web servers are fully redundant and actively load-balanced. Any individual machine can fail completely without interrupting public access to ClickTime. In addition, customer traffic is always routed to the fastest available system.
Data Storage
On-Site Backup
The ClickTime database (containing all live customer data) is backed up every 30 minutes to multiple machines on the same network within the same colocation facility. Therefore, maximum potential data loss in the event of a primary and secondary database failure is approximately 30 minutes.
Off-Site Backup
An encrypted snapshot of the ClickTime database (containing all live customer data) is sent twice daily to a storage datacenter, rendering data loss in the event of a regional disaster minimal.
Secondary Facilities
In the event that ClickTime’s primary datacenter is damaged or unavailable, ClickTime maintains the ability to restore access to a cloud based DR site.
Data Deletion
We securely delete (ex. degaussing / cryptographic wiping) and destroy retired equipment and media (hard drives, SSDs, etc.).
Availability & reliability
ClickTime has maintained over 99.9% uptime since 1999—over 9,000 consecutive days and counting, without interruption. We publish system status updates on our system blog.
Operational security
Continuous monitoring, regular security audits, and proactive incident response measures are the pillars of our commitment to maintain the integrity and confidentiality of our clients’ data.
Personnel Security
We perform background checks, signed confidentiality agreements, security policy / procedure acknowledgment, annual security training, and acceptable use agreements in addition to termination / access removal processes. Access to our systems and your data is restricted only to those who need it, based on the principles of least privilege.
Endpoint Security
In order to ensure the security of company-owned devices, we use endpoint encryption, antivirus protection, and endpoint management tools. We maintain a complete inventory of all our critical assets, and upon termination of contract or business relationship, employees and business partners are adequately informed of their obligations for returning organizationally-owned assets.
Vendor Management
Every subprocessor of ours undergoes a rigorous procurement process, including a thorough evaluation of their security measures, to confirm their commitment aligns with the high level of trust we extend to our customers. Following their integration into our supply chain, we conduct annual security audits on each provider to maintain the integrity of our services.
Business Continuity & Disaster Response
While we work tirelessly to prevent them, disasters happen and that is why we create, maintain, and execute plans for them. At a minimum, once a year, we come together to assess new risks, design new plans, review existing plans, and test likely failure scenarios to exercise the plans as if they were occurring in real time.
Incident Management & Response
In the unlikely event of a security breach, ClickTime will promptly notify you of any unauthorized access to your data. To report a security or privacy issue, email us at securityincidents@clicktime.com.
Data Protection Officer
ClickTime has appointed a data protection officer where such appointment is required by Data Protection Laws and Regulations. The appointed person may be reached at privacy@clicktime.com