What happens to your team's data

Servers, database, file storage and backups run exclusively in data centres in the EU. No processing takes place outside the EU.

• The hosting provider is named with company, seat and data-centre location in Annex 2 of the data processing agreement as soon as the production system goes live — until then it says so openly instead of making a promise.
• ISO 27001 certification and physical access control are requirements on that provider.
• Administrative access only through personal accounts with SSH keys; no shared account.

In transit and at rest. Credentials live outside the source code, login codes only as a salted hash.

• Transport exclusively over TLS 1.2 or higher.
• The database sits on a volume encrypted with LUKS (dm-crypt, AES-XTS).
• Documents, exports and backups are stored server-side encrypted in object storage (SSE).

The sticker carries an NTAG 424 DNA. It stores nothing about your employees; it computes on every touch.

• On every touch the chip derives a fresh checksum (SUN/CMAC) from its secret key, its serial number and an internal counter, and appends it to the address.
• The counter only ever moves up. Replaying a captured touch is rejected because its counter value is already spent.
• The keys never leave the chip and never sit on the phone: only the server, which knows that chip's key, can verify them.
• A copy of the sticker would carry the same address but no valid key — it is refused with «bad_cmac».
• On top of that the phone signs every booking with its own key pair, and exactly one device is bound per person.

NymTime stores no coordinates and no routes — neither from the presence check nor anywhere else.

• All that is stored is whether the phone was «inside the zone» or «outside» during the shift, with the time and the accuracy in metres.
• The check runs only during the shift, never before or after.
• It runs only for employees with a legal basis on file: a works agreement under § 96 para 1 no 3 ArbVG or written, revocable consent under § 10 AVRAG.
• Raw presence events are condensed after three months.

Your business decides who sees what. In normal operation we see nothing.

• Role- and permission-based access: managers are limited to their locations, payroll and staff-cost data are visible to management only.
• Back Office login with an e-mail address and a password. The password is never stored in clear text but as a scrypt hash with its own salt; after 10 failed attempts the account locks temporarily, and requests are limited per address and per IP address.
• Optional for the whole business: two-factor sign-in with a time code from an authenticator app (TOTP). No sign-in by text message — a phone number is not needed for access.
• No access by NymTime to customer data in normal operation. Support access only after you enable it, with scope, duration and revocation at any time.
• Every security-relevant action is in the log: who, what, when, before and after. The log can only be appended to — a database rule prevents changing and deleting.

Periods per kind of data, configurable — but never below the statutory minimum.

• Working-time records 84 months (minimum 12 months under § 26 AZG, § 132 BAO), payroll documents 84 months.
• Raw presence events 3 months, employee messages 12 months, notifications 6 months.
• A daily run deletes and anonymises automatically and writes down what it did.
• Deletion carries a timestamp (soft delete); archived profiles are anonymised once the period ends.

Your business is the controller, NymTime is the processor. The agreement is part of the purchase and readable at any time.

• Data processing agreement under Art. 28(3) GDPR with data categories (Annex 1), sub-processors (Annex 2) and technical and organisational measures (Annex 3).
• Templates for a works agreement, consent under § 10 AVRAG and a data protection impact assessment are sent by e-mail on request.
• Notification of personal data breaches to you within 48 hours; a record of processing activities under Art. 30(2) GDPR is in place.

A shorter list than what we do — and at least as important.

• No cookies, no analytics, no trackers, no content delivery network. The fonts sit on our own server.
• No sharing or selling of data, no advertising, no profiling.
• No training of AI models on your data.
• No coordinates, no movement profiles, no photos, no audio.
• No diagnoses in sick leave — only the period and the status.