What happens to your team's data

Employee and business data (time records, schedules, documents) are hosted in the EU (Hetzner Online GmbH, Falkenstein data centre). Cloudflare serves the website and forwards the traffic to the service (the connection is decrypted there and encrypted again); Resend sends the e-mails, payments run through Stripe. All processors and third-country transfers are listed in the privacy policy and the DPA.

• The hosting provider of the service is Hetzner Online GmbH, Gunzenhausen (DE), Falkenstein data centre — named with company, seat and location in Annex 2 of the data processing agreement; Cloudflare is listed there as the provider of the website and the reverse proxy in front of the service, together with Resend (e-mail) and Expo (push notifications).
• ISO 27001 certification and physical access control are requirements on that provider.
• Administrative access only through personal accounts with SSH keys; no shared account.

In transit and at rest. Credentials live outside the source code, login codes only as a salted hash.

• Transport exclusively over TLS 1.2 or higher.
• The database sits on a volume encrypted with LUKS (dm-crypt, AES-XTS).
• The application encrypts documents with AES-256-GCM before storing them; the keys are held only on the application servers.
• pgBackRest encrypts database backups with AES-256 before they are stored in object storage in the EU.

Every NFC tag carries an NXP NTAG424 DNA chip. It is set up so that every touch produces a one-time, cryptographically signed code that the NymTime server verifies; a recorded code cannot be used again. The chip key is disclosed neither to the phone nor to users.

• On every touch the chip derives a fresh checksum (SUN/CMAC) from its secret key, its serial number and an internal counter, and appends it to the address.
• The counter only ever moves up. Replaying a captured touch is rejected because its counter value is already spent.
• The chip key is disclosed neither to the phone nor to users; verification is done by the NymTime server.
• The scheme is designed to prevent copies: a replica of the NFC tag would carry the same address but no valid key — its code is refused («bad_cmac»).
• On top of that the phone signs every time entry with its own key pair, and exactly one device is bound per person.

NymTime stores no coordinates and no routes — neither from the presence check nor anywhere else.

• All that is stored is whether the phone was «inside the zone» or «outside» at the moment of the time entry, with the time and the accuracy in metres.
• The check runs only when clocking in or out during the shift — no background location tracking, never before or after.
• The site check is off by default and can only be switched on once the business has completed the steps for its country — depending on the country and the size of the business, for example employee information, a works agreement or consultation, a data protection impact assessment and a waiting period. We provide the templates; the assessment of the individual case is made by your legal adviser.
• Raw presence events are condensed after three months.

Your business decides who sees what. In normal operation we see nothing.

• Role- and permission-based access: managers are limited to their locations, payroll and staff-cost data are visible only to management and to managers it authorises.
• Back Office login with an e-mail address and a password. The password is never stored in clear text but as a scrypt hash with its own salt; after 10 failed attempts the account locks temporarily, and requests are limited per address and per IP address.
• Optional for the whole business: two-factor sign-in with a time code from an authenticator app (TOTP). No sign-in by text message — a phone number is not needed for access.
• No access by NymTime to customer data in normal operation. Support access only after you enable it, with scope, duration and revocation at any time.
• Every security-relevant action is in the log: who, what, when, before and after. The log can only be appended to — a database rule prevents changing and deleting.

Periods per kind of data, configurable — but never below the statutory minimum.

• Working-time records 84 months (minimum 12 months under § 26 AZG, § 132 BAO), payroll documents 84 months.
• Raw presence events 3 months, employee messages 12 months, notifications 6 months.
• A daily run deletes and anonymises automatically and writes down what it did.
• Deletion carries a timestamp (soft delete); archived profiles are anonymised once the period ends.

Your business is the controller, NymTime is the processor. The agreement is part of the purchase and readable at any time.

• Data processing agreement under Art. 28(3) GDPR with data categories (Annex 1), sub-processors (Annex 2) and technical and organisational measures (Annex 3).
• The Back Office creates the templates for your country's steps (employee information, contract clause, works agreement, data protection impact assessment) in the country's language and in German.
• Notification of personal data breaches to you within 48 hours; a record of processing activities under Art. 30(2) GDPR is in place.

A shorter list than what we do — and at least as important.

• No cookies on the website, no analytics, no trackers; in the Back Office only strictly necessary and functional cookies (privacy policy, section 4). We serve the fonts ourselves — no connection to Google Fonts or any other font service.
• No sharing or selling of data, no advertising, no profiling.
• No training of AI models on your data.
• No coordinates, no movement profiles, no audio, no photos when clocking — images only when employees upload a document such as a sick note themselves.
• No diagnoses in sick leave — only the period and the status.