Time and calendar data are sensitive. Here's exactly how we protect yours.
Every query is scoped to your organisation at the application layer. No row in our database can be returned to another tenant — period. We use a sharded tenant database where each org's data lives behind its own encrypted connection string.
When you connect Google Calendar, the events are scoped to YOUR account — not even other members of your own org can see them. We never use your calendar data to train models for other customers.
Plus tier AI inference runs on-device — meeting titles never leave your browser. Only Pro's "Get an AI take" sends sanitised meeting context to a cloud LLM, and only when you explicitly click the button. Bodies, full attendee emails, and free-text notes are stripped before any cloud call.
We don't sell your data, and we never use it to train AI models for the benefit of other customers. Your time entries, invoices, clients, and meeting context exist to run Timsio for you — nothing else. Cross-organisation learning is forbidden by design, not by policy: one subscriber's patterns can never influence another subscriber's suggestions.
TLS 1.2+ for all traffic. Database encryption at rest. OAuth refresh tokens encrypted with AES-256-GCM. Tenant database connection strings stored encrypted; the master key never touches our application database.
Every create, update, and delete is recorded with actor, timestamp, before/after diff, and IP. Pro plans get 90-day retention plus the History panel on every entity. Every super-admin impersonation is logged separately and cannot be deleted.
We are early, and we would rather say so than overstate it. GDPR: you can export your data from inside the app, and you can ask us to delete your personal information by writing to support@timsio.com. SOC 2, ISO 27001 and HIPAA: not certified. If a certification is blocking your adoption, tell us — it moves up our roadmap when a real customer needs it.
We publish our sub-processors, and we will answer specific questions about our architecture, data handling, or retention directly. Ask us anything.
support@timsio.comOr see the companies that process your data on our sub-processors page.