Hosted in Germany
Frankfurt, on European infrastructure. Encrypted in transit and at rest. A processing agreement is signed before you add a client — not after.
Security & access
Letting a client in is the whole product. So it’s the part we built first.
Most tools hand clients a guest seat and hope nobody clicks the wrong thing. Here, isolation is a rule in the database itself, on every record, deny-by-default — and nothing new goes live without one.
The guarantee
Five things a client never receives.
Not hidden in the interface, not filtered on the way out — simply not in the answer at all. Every line below is checked automatically, before anything we ship goes live.
| What never reaches them | Why it stays inside |
|---|---|
| Your time notes | Why an hour took as long as it did |
| Your internal estimate | What you thought it would take, next to what you quoted |
| Your rates and your margin | What the work costs you, and what you make on it |
| Internal items and comments | The conversation about their request, and work they never asked for |
| Anything of another customer’s | Every list they open contains nothing belonging to anyone else |
Hidden means hidden
Asking for an internal item directly returns nothing at all. A “you are not allowed to see this” would confirm that it exists, which is a leak in itself.
No monetary value for a client member
Not a rate, not a total, not an estimate in euros — on any surface, in any export, through any parameter.
Nothing new ships without it
Anywhere new that your data can live gets its own isolation rule before it goes live — and if it doesn’t, the release stops. Forgetting is not one of the available mistakes.
Roles
Five roles, and the smallest one is the important one.
A client member is scoped to named projects — not to their company’s whole account. That’s what makes it safe to invite a team lead who should see one project and nothing else.
People are deactivated, never deleted: sessions are revoked within seconds, every scope is removed, and their name stays on the feed entries, comments and hours they authored.
| Role | Reaches | Money |
|---|---|---|
| Owner | Everything, including rates and margin | |
| Employee | All customers and projects, own and others’ time | billing only |
| Freelancer | Assigned projects only, own time only | — |
| Client admin | Their account, all their projects, approvals | own bill |
| Client member | Named projects only, no approvals | — |
Data & operations
Where it lives and what happens to it.
Audit log on every mutation
Who changed what, when, and from where — including approvals, visibility switches and deactivations. Exportable on Network.
Your data leaves when you do
Items, hours, feed and attachments, in formats a spreadsheet opens — no export fee and no thirty-day hostage window. Ask and we run it for you today; the one-button archive is on the roadmap, not in the product yet.
Sign-in that suits both sides
Password or a single-use link that expires in 15 minutes. Invite links work once and can’t escalate the role they carry. SSO on Network.
Nothing you record is silently rewritten
Raw minutes are stored forever; rounding is a display and invoicing decision. An invoiced entry freezes, and a correction is a counter-entry that leaves both sides visible.
No training on your data
Your items, hours and client conversations are not used to train anything, ours or anyone else’s. Sub-processors are listed and notified before they change.
Bring your security questionnaire. We’d rather answer it now.
Ask for the DPA, the sub-processor list and the negative test suite before you sign anything.