Security Practices

1. The controls in place

2. How the platform is put together

UseTimio is a multi-tenant application. Each organization gets its own subdomain and its own isolated set of records; the application resolves the tenant from the hostname on every request and scopes data access to it. Administrative surfaces — the organization admin portal and our own super-admin console — are separate route groups with separate authentication, so a normal member session cannot reach an admin endpoint by guessing a URL.

Infrastructure is managed rather than self-hosted: the application runs on Vercel, the database on MongoDB Atlas, object storage on Cloudflare R2, and background jobs through a managed Redis service. We inherit those providers’ physical security, patching and network controls, and we list each of them on the sub-processors page.

3. Account security

• Email verification is required before an account becomes usable.
• Passwords are never stored or emailed in plain text; resets are done through a time-limited link.
• Repeated failed sign-in attempts are throttled.
• Biometric check-in uses WebAuthn, so the biometric itself never leaves the device — see Data Safety.
• Roles are least-privilege by default: a new member sees only their own record until an admin says otherwise.

4. How we build and ship

• Changes are version-controlled and reviewed before they reach production.
• Dependencies are updated on a regular cadence, and security advisories are treated as priority work.
• Production data is not copied into development environments; test data is synthetic.
• Deployments are immutable and can be rolled back to the previous release quickly.

5. Availability and recovery

The database is backed up daily to object storage, and the fourteen most recent backups are kept. Our recovery objective is to restore service from the most recent backup within one business day of declaring a catastrophic failure, with at most 24 hours of data loss. We do not offer a contractual uptime SLA on self-serve plans; Enterprise customers can ask for one in writing.

Check-in itself is resilient to network loss: the progressive web app queues check-ins made offline on the device and syncs them when connectivity returns, so a dropped connection at the gate does not lose the record.

6. Incident response

1. Detect and triage — we assess what happened, what data is involved and whether it is ongoing.
2. Contain — revoke credentials, block the route in, and stop the bleeding before anything else.
3. Notify — affected organization owners are told without undue delay and within 72 hours of our becoming aware, by email to the owner address on file.
4. Regulators — where the law requires it, we notify the Nigeria Data Protection Commission, and any other competent supervisory authority, within the statutory window.
5. Remediate and write up — we fix the root cause and share what we found with affected customers.

7. Reporting a vulnerability

If you believe you have found a security flaw, email info@usetimio.com with “Security” in the subject line and enough detail to reproduce it. We will acknowledge within 5 business days and keep you updated until it is resolved.

We will not pursue action against researchers who act in good faith: test only against accounts you own, never access or modify another organization’s data, do not degrade the service for others, and give us a reasonable window to fix the issue before disclosing it. Automated scanning of production, denial-of-service testing and social engineering of our staff or customers are out of scope. We do not currently run a paid bounty programme.

8. What we need from you

Most real-world incidents start with an account, not a server. Your part:

• Use a strong, unique password for the owner account, and do not share it between admins.
• Give people the lowest role that lets them do their job, and remove accounts when they leave.
• Keep the owner email address current — it is where breach and billing notices go.
• Treat exported CSVs as sensitive: they leave our controls the moment they are downloaded.
• Tell us immediately if you suspect an account has been compromised.

9. Certifications — being straight with you

UseTimio is not currently ISO 27001 or SOC 2 certified, and we will not imply otherwise. We build on infrastructure providers that hold those certifications, and we apply the practices described above. If your procurement process needs a security questionnaire completed, write to us and we will fill it in honestly.