Security & trust
Security that passes review by IT, HR and auditors
TIMEOFF.GURU holds sensitive data about your people: absences, sick notes, signed leave orders. That is why our security is certified, checked by independent auditors and described in plain words.
- ISO/IEC 27001Information security
- ISO/IEC 27017Cloud service security
- ISO/IEC 27701Privacy information management
- ISO 22301Business continuity
- GDPREU data
Certification New
One certificate. Now covering cloud services too.
Our information security management system now also covers ISO/IEC 27017, the standard for security controls in cloud services.
ISO/IEC 27017 is part of the ISO/IEC 27000 family and extends ISO/IEC 27001. So we still have one certificate, and its scope now includes cloud services.
What this means for you
- Independent confirmation that we run our cloud services by internationally recognised security rules.
- Ready answers for your security team, your data protection officer and your auditors.
- ISO/IEC 27001
Information security
The framework we use to manage risks and data protection controls. Checked by an independent certification body.
- ISO/IEC 27017
Cloud services
Extra controls for the cloud: separation of customer data, clear responsibilities for provider and customer, protection of the virtual environment.
How we protect data
Protection at every level
Encryption and isolation
- All traffic between browsers, mobile apps and servers is encrypted (HTTPS).
- Each customer's data sits in a separate, protected instance.
- Passwords are hashed one way. Nobody can read them, including us.
Sign-in and identity
- Two-factor authentication with a code sent by email.
- Single sign-on with Active Directory via SAML, Google, OAuth or LDAP.
- Password rules: minimum length and four levels of complexity.
Role-based access
- Separate roles for administrators, HR, reports, finance and the last level of approval.
- Only HR sees attached files, such as sick notes.
- You decide who can act on behalf of others.
Audit trail
- Every action is written to an audit log.
- The history of each request shows who did what, and when.
- Leave orders can be signed with a qualified e-signature. Signed XML and PDF files are downloadable from reports.
Infrastructure
- Our primary data centre is Equinix IBX in Sofia.
- Distributed, container-based architecture.
- Your data stays in the European Union.
Backups
- Restore to a specific day, hour and minute.
- Backups are kept in a secure, physically separate location.
- Business continuity is certified to ISO 22301, including for the cloud services.
Personal data
GDPR from day one
- You are the data controller and we are the processor. We sign a data processing agreement (DPA).
- Our privacy information management system is certified to ISO/IEC 27701.
- Data is stored in the European Union.
- When your subscription ends, your data is destroyed immediately, following set procedures.
Your settings
You set the rules
Your administrators configure protection to match your internal policies, without waiting for us:
- password complexity and minimum length;
- two-factor authentication and how often it is required;
- sign-in through your identity provider;
- roles, assistants and acting on behalf of others.
Documents for your review
For your IT security team, your data protection officer and public tenders.
- ISO/IEC 27001 (with ISO/IEC 27017), ISO/IEC 27701, ISO 22301, ISO/IEC 20000-1 and ISO 9001 certificates
- Data processing agreement (DPA)
- List of sub-processors
- Answers to a vendor security questionnaire
Found a vulnerability?
Write to support@timeoff.guru with the subject “Security”. Describe the issue and how to reproduce it. Please do not publish details before we have fixed it.
support@timeoff.guruSecurity questions
All questions →Where is our data stored?
Our primary data centre is Equinix IBX in Sofia, in the European Union. Backups are kept in a physically separate location. All traffic is encrypted, and our information security management is certified to ISO/IEC 27001 and ISO/IEC 27017. See the Security page for details.
Is the system GDPR compliant?
Yes. If you need a data processing agreement (DPA), write to us.
Is two-factor authentication supported?
Yes. The administrator enables two-factor authentication (2FA) and chooses how often it is required. When logging in, the system emails a code. If you sign in through Active Directory or another provider (SSO), its rules apply.
What does ISO/IEC 27017 certification mean?
ISO/IEC 27017 is the standard for security controls in cloud services. It extends ISO/IEC 27001, so we still have one certificate, and its scope now includes cloud services.
For you, it is independent confirmation that we run our cloud services by internationally recognised rules. When your security team or auditors review your suppliers, the certificate answers many of their questions.
Are actions in the system logged?
Yes. Every action is written to an audit log. The history of each request shows who did what and when, including who rejected a request and why.
What happens to our data if we cancel?
Your data is destroyed immediately after the subscription ends, following set procedures.
Which documents can we get for a vendor assessment?
The ISO/IEC 27001 (with ISO/IEC 27017 in scope), ISO/IEC 27701, ISO 22301, ISO/IEC 20000-1 and ISO 9001 certificates, a data processing agreement (DPA), the list of sub-processors and answers to a security questionnaire. Write to us.
Retire the leave spreadsheet this week.
14 days free, full access, no credit card. Or let us show you around in 20 minutes.
or book a demo →