Authentication
Passwords are hashed with Argon2. The API issues short-lived access tokens and refresh tokens, and supports refresh-token rotation. Web sessions are stored in HTTP-only cookies so application JavaScript does not need direct access to authentication tokens.
Desktop devices can be registered and associated with user accounts. Device secrets are hashed before storage and protected endpoints verify active user and organization context.
Authorization and tenant boundaries
Timerflow applies role-based permissions across projects, tracked time, screenshots, idle decisions, organization administration, and analytics. Organization membership and permission dependencies are checked by protected API routes before data is returned or changed.
Default roles include owner, administrator, manager, member, and contractor. Organizations can add custom roles while protected defaults retain lifecycle safeguards.
Screenshot and object-storage workflow
Screenshot uploads use time-limited presigned requests to S3-compatible storage. Background workers promote submitted objects, generate thumbnails, and update processing status. Storage credentials remain server-side rather than being embedded in desktop or web clients.
Reliable ingestion
The desktop synchronization pipeline uses durable local queues, retry classification, and idempotent ingestion identifiers. These controls reduce the risk of losing tracked work during network interruptions or creating duplicate entries after a retry.
Deployment protection
- HTTPS termination is provided by the production reverse proxy.
- Application secrets and service credentials are supplied through environment configuration.
- PostgreSQL, Redis, and object storage are kept behind application-facing services.
- Background media processing runs separately from request-serving API processes.
Encryption at rest, backup schedules, network rules, monitoring, and regional placement depend on the selected hosting environment and must be verified before production rollout.
Reporting security concerns
Security questions or suspected vulnerabilities can be reported privately to security@timerflow.space. Do not include sensitive customer or employee data in the initial message.