actiTIME Terms & Policies

Security Policy

Last Updated: September 2023

Protecting customer data is an essential and integral part of the services offered by actiTIME. Below, we outline our approach and the security measures used to keep our customer data safe and secure.

1. Company and Product Overview

   actiTIME Inc. (actiTIME) is an international software company specializing in time and scope management systems. Since 2000, actiTIME is committed to bringing actionable business data to enterprises, freelancers and solo entrepreneurs, driving business growth and delivering better business outcomes. Today, over 9000 customers in more than 70 countries are using actiTIME products to record work hours, manage project scopes and keep everything on track with the insightful data.

2. Product Infrastructure and Data Centers

   1. actiTIME develops, sells and services software solutions for business customers. actiTIME products are offered in two forms: self-hosted (on-premise) and online (SaaS mentioned below).
   2. Self-hosted products are installed locally on customer owned equipment and by customer’s own personnel. The customer takes the entire responsibility for the security of installation and application data.
   3. Online products are Java-based web applications provided on the SaaS model. They are hosted in data centers of the Amazon Web Services (AWS), world-class cloud infrastructure provider
   4. When delivering online products, actiTIME shares the security responsibilities with its data center provider. actiTIME is responsible for technical maintenance, data protection and overall security of the online application. Amazon Web Services is responsible for the underlying cloud infrastructure and its physical and network security.
   5. Geographically, data centers are located in the United States and Germany. Customers may specify their preference for storing their data in the U.S. or German data centers of Amazon Web Services.

3. Application Security

   actiTIME is committed to ensuring high levels of application security. Our protection scope includes data transfer, network configuration, and application-level access controls.

   1. End users of the application have a unique account associated with their email address, and protected with a password. User passwords are securely stored in customer’s dedicated database and protected by a hashing mechanism.
   2. End users do not have administrative or root access to any portion of the technology stack of actiTIME products. Access is allowed only via the application layer (UI or REST API). Access levels within the application are managed by customers through use of appropriate userspecific permissions.
   3. Firewall rules and access control lists are used to control network traffic and network access to the application.
   4. SSL/TLS encryption is used to protect data in transit, both when users access the application from a web browser or a mobile app. Users are not allowed to access the application via HTTP and are forced to use an HTTPS connection.
   5. Record of events is kept using access logs.
   6. To ensure ongoing security and correct functionality of the application, actiTIME follows a regular update and patching cycle. Major releases of new functionality are issued once a year, and minor updates are released every 3-4 months. With online products, the update process is fully automated. Customers with self-hosted products hold all responsibility for keeping the software current and installing the updates.
   7. Code review is performed to eliminate security weaknesses and ensure high code quality of the application.
   8. To ensure higher levels of security, actiTIME has procedures in place to update the software components of the online application on a regular basis. The latest versions of Java, Tomcat and MySQL are used. Critical updates, like security patches, are installed immediately upon becoming available.

4. Privacy and Data Security

   1. Privacy
      1. actiTIME processes customer data in order to provide its services. Data contained within the application is submitted and controlled by the customer, and not by actiTIME. Full actiTIME privacy policy is available here.
      2. actiTIME may also collect business contact information for other legitimate business purposes, namely:
         • • To communicate with its customers and provide customer support;
           • To send important service-related notices and inform users about any service changes or offerings;
           • To enhance user experience and detect or debug crashes in our products.

         Product end users may opt out of any communications with actiTIME via standard unsubscribe mechanisms or by contacting actiTIME support team.

   2. Data Protection
      1. Each customer’s data is segregated from other customers’ data through use of separate database instances.
      2. Customer data is never stored or transferred on any removable storage devices (e.g., thumb drives, CDs, external hard drives).
      3. In case of any data breach, actiTIME will notify the customer within 24 hours of becoming aware of such event, will investigate it internally and take reasonable steps to minimize any damage.
      4. To maintain data integrity and security, full backups are performed daily. Backup copies are stored within AWS data center facilities
      5. Customers retain full control over their data with tools available in the application. A full copy of the company data in .sql format can be provided upon request.
      6. In the event of service termination or cancellation, all customer data can be completely removed from actiTIME hosting and backup facilities within 72 hours upon customer’s written request.

5. Cross-Border Data Transfers and Data Storage

   1. Data of European customers is processed and stored on servers located exclusively within the European Union (in Germany). actiTIME undertakes not to transfer any data of such customers outside the European Economic Area.
   2. Data of non-EU/EEA customers is processed and stored on servers located in the U.S. If you are a EU/EEA citizen working for a non-EU/EEA company, this means that your personal information will be transferred to the U.S.
   3. To be able to lawfully transfer personal data from individuals in the EU/EEA, actiTIME relies on compliance mechanisms offered by its data center provider, Amazon Web Services (AWS). Amazon Web Services is certified under the EU-U.S. Privacy Shield and adheres to its principles. Additional details are available here.
   4. If you do not want your personal information to be transferred to the U.S., you may contact actiTIME to arrange data storage on servers based in Europe.

6. Systems and Information Access Control

   1. Access Policies and Procedures
      1. Access to corporate and production environments is strictly limited in accordance with the job roles. Users are only minimally given sufficient access rights to enable them to perform their job function.
      2. Where possible, none of the staff members is granted full rights to access any system. Network/server passwords are controlled by responsible IT specialists, and system passwords are assigned by the system administrator in the end-user department.
      3. Only a small group of authorized actiTIME staff members can access data center environment and production servers. Person who is no longer affiliated with actiTIME is restricted from accessing any actiTIME servers within 24 hours. User accounts of terminated staff are promptly disabled and removed.
      4. Staff access to production servers is performed from a special environment installed in AWS and secured through encrypted channels and usage of SSH keys.
      5. Access to customer data or production environments from any mobile computing devices (e.g., laptops, smartphones, or tablets) is prohibited through implementation of appropriate technical measures and internal policies.
   2. Secure Authentication
      1. actiTIME staff members are required to use personal usernames and complex passwords, which should not be shared among users.
      2. Default passwords on all systems are changed after installation and changed periodically.
      3. Network/server supervisor passwords and system supervisor passwords are stored in a secure location in case of an emergency or disaster.
   3. Monitoring System Access
      1. Access to the application web servers is logged, and all access events are available for later auditing.
      2. Intruder detection is implemented where possible.

7. Corporate Offices – Physical Security

   1. Workstations
      1. Users must log out of their workstations when they leave their workstation for any length of time. Alternatively, Windows workstations may be locked.
      2. Session timeouts are kept in accordance with the best business practices.
      3. All unused workstations must be switched off outside working hours.
   2. Server Access
      1. All servers are kept securely under lock and key.
      2. Access to the system console and server disk/tape drives is restricted to the authorized personnel only.
      3. The operating system is kept up to date and patched on a regular basis.
      4. Use of the Admin/Administrator/root accounts is kept to a minimum.
      5. Corporate servers may be used for internal needs only. All product infrastructure and customer data are hosted in the data centers of Amazon Web Services, who is responsible for ensuring physical and environmental security of this infrastructure.
   3. Electrical Security
      1. Electrical equipment is connected according to the local codes and regulations.
      2. All servers and network equipment is fitted with UPS units that also condition the power supply. All UPS units are tested periodically to ensure their operability.
      3. All servers are equipped with special software to implement an orderly shutdown in the event of a total power failure.

8. Corporate Offices – Computer and Network Security

   1. Virus Protection
      1. Up to date virus scanning software is used regularly for the scanning and removal of suspected viruses at the corporate file servers, workstations and other devices.
      2. Antivirus software is managed centrally by responsible IT staff.
      3. All removable media from external sources is virus checked before they are used.
      4. All systems are built from original, clean master copies whose write protection has always been in place. Only original master copies may be used until virus scanning has taken place.
      5. All removable media containing executable software (software with .EXE and .COM extensions) is write protected wherever possible.
      6. Shareware is not to be used, as shareware is one of the most common infection sources. If it is absolutely necessary to use shareware it must be thoroughly scanned before use.
      7. New commercial software must be scanned before it is installed as it occasionally contains viruses.
      8. To enable data to be recovered in the event of a virus outbreak, backups are performed on a regular basis.
      9. Users will be notified of virus incidents. They are instructed to inform the responsible IT specialists immediately about any virus-related incidents or possible computer virus infection.
   2. LAN Security
      1. All unused network points are de-activated when not in use
      2. Users must not place or store any item on top of network cabling.
      3. Redundant cabling schemes are used where possible.
   3. Acceptable Use of Corporate IT Assets
      1. Users must not use personal email accounts and access social networking websites for reasons unrelated to actiTIME business.
      2. Users must not download or distribute files from unauthorized or questionable sources, nor download non-work related files.
      3. Users are prohibited from sharing any sensitive work-related information on social media or other publicly accessible websites.

9. Security Audits and Risk Management

   1. Risk assessment is an integral part of all management and development processes in actiTIME.
   2. Prior to any significant changes in operational IT systems, a technical risk assessment is performed by the technical team. The functionality releases and changes are supported by rigorous testing before live release.
   3. In order to identify and mitigate potential security risks, actiTIME performs regular vulnerability assessments and review of implemented security measures. External audits are performed on an ad-hoc basis. Upon review, security vulnerabilities and bugs are evaluated and patched in order of priority.
   4. actiTIME does not share audit reports with its potential and existing customers due to security and confidentiality concerns.

10. Business Continuity

    1. Although actiTIME does not offer a service level agreement or guarantee any certain uptime, all efforts are taken to keep uptime and availability as high as possible.
    2. actiTIME uses cloud infrastructure which provides monthly uptime of at least 99.95%, as defined in the Service Level Agreement of Amazon Web Services. High availability of service is maintained through use of Amazon’s Availability Zones.
    3. Product architecture has been specifically designed to ensure scalability and resiliency of the application.
    4. In the event of any potential outages and disruptions of the service, actiTIME will make best efforts to minimize business impact for its customers.
    5. actiTIME has established procedures in place covering data backup and recovery. The defined Recovery Point Objective (RPO) is 24 hours, and the Recovery Time Objective (RTO) is 24 hours.

11. Incidents Management

    1. actiTIME maintains a dedicated DevOps and Security team to take care of all cloud operations and cloud security. The team is available 24/7 to respond to a security or availability incident and to notify the affected parties.
    2. actiTIME has implemented technical measures to detect and monitor malicious or abnormal activities and alert responsible staff. Infrastructure engineers work together with the product team to ensure secure deployment and operations in the cloud at all times.

12. Compliance

    1. While actiTIME hasn’t undergone a full-compliance certification, applications are developed and deployed with due awareness and in accordance with industry best practices. actiTIME’s data center provider, Amazon Web Services, is certified under NIST, ISO 27001, SOC 1/2/3, and a number of other certifications.
    2. To ensure compliance with industry security standards, actiTIME DevOps and Security team members monitor best practice methods through attending seminars, training, workshops and conferences, and seek to implement them where appropriate.

13. Employee Awareness and Responsibilities

    1. This Policy is reviewed and approved at least annually, and enforced by the actiTIME DevOps and Security team.
    2. All actiTIME staff and subcontractors are required to read, accept and sign an NDA and the Policy. Access to the corporate and production environments is granted only upon completion of this process.
    3. All actiTIME staff members are responsible for identifying and reporting potential information security risks. Each and every information security incident must be immediately reported to the management.
    4. In case of any questions in regard to this policy, please contact us:

       Contact email: cisg@actitime.com

       Contact phone number: +1 (917) 310 35 75

Version history