Security

Every application table enforces PostgreSQL row-level security. Authorisation is applied by the database itself rather than only by application code, so a bug in a query cannot return another organisation's rows. Privileged database functions run with a fixed search path and fail closed when a caller cannot be verified.

Passwords are hashed with bcrypt and never stored in recoverable form. We enforce a minimum password length and character requirements, and reject passwords known to have appeared in public breaches.

API keys are stored only as hashes, are shown once at creation, and can be revoked instantly, with revocation taking effect on the next request. Administrative access is limited to an explicit allowlist.

Data is encrypted in transit using TLS, and at rest by our hosting provider. Off-site backups are encrypted before they leave the platform, using a key held separately from the backup storage.

Two independent layers protect your data. The hosting platform maintains its own automated backups for fast recovery from operational mistakes. Separately, an encrypted logical backup is written nightly to storage held with a different vendor, under separate credentials, so that a compromise of the primary platform cannot reach or destroy the backups. Each backup is verified for integrity before it is stored, retained on a rolling schedule, and restores are tested periodically.

API endpoints apply per-caller and per-IP rate limits backed by a shared counter, so limits hold across all running instances rather than resetting per process. Plan allowances are metered in the database. A compromised or runaway client is throttled rather than able to exhaust capacity or run up cost, and we may apply automatic limits before a person reviews the case.

Application errors and security-relevant events are recorded to a durable, admin-only ledger and alerted on. Unhandled failures return a generic error with a reference rather than exposing internal detail to the caller. We maintain a documented incident procedure covering credential rotation, key revocation, evidence preservation and customer notification.

Where a personal data breach affects customer data, we notify the affected customer without undue delay and within 48 hours, as committed in our DPA.

You can download everything we hold for your account as a single file, and permanently erase your account and data, from Account & data. No request or waiting period is required. Erasure preserves only the invoice records we are legally required to retain.

We welcome responsible disclosure. Email security@timespan.online with enough detail to reproduce the issue. We aim to acknowledge within 2 business days and to keep you updated until resolution.

Please do not access, modify or exfiltrate data belonging to any other customer, perform denial-of-service testing, or socially engineer our staff or suppliers. We will not pursue legal action against researchers who follow this policy in good faith.