Layer 01
Security posture
Encryption in transit
All traffic is served over TLS 1.2+ with modern cipher suites. HSTS is enabled on the production domain.
Encryption at rest
Databases and uploaded files are encrypted at rest with AES-256 via our managed database and object storage providers.
Authentication
Email + password sign-in is supported today. TOTP-based two-factor authentication is available for every user and can be enforced workspace-wide by owners and admins. We strongly recommend enabling 2FA for all workspace users. Google SSO and SAML SSO are on the roadmap.
Access control
Row-level security is enforced at the database layer. Every query is scoped to the caller's workspace; cross-workspace access is structurally prevented.
Isolated workspaces
Each organisation lives in its own logical workspace. Datasets, reports and evidence are partitioned by workspace ID and enforced by row-level security, so they are never co-mingled across customers.
Hosting region
Primary database and object storage are hosted in Asia Pacific (Singapore) by our managed database provider. Application traffic is served from the Cloudflare edge globally. Additional regions are on the roadmap.
Certified infrastructure
Hosted on SOC 2 Type II and ISO 27001 certified infrastructure, audited to SOC 2 Type II standards. Operated in line with regional privacy and data-protection laws across Australia (Privacy Act 1988 / APPs), the United States (incl. CCPA/CPRA and other state privacy laws) and the EU/UK (GDPR).
Layer 02
Data handling guarantees
- Purpose limitationWe only process the payroll and timekeeping data you upload for the purpose of running the analyses you request. Your data is never used to train shared models, never sold, and never shared with third parties beyond the providers listed below.
- Retention & deletionRaw uploaded files are retained for 90 days by default and then purged automatically. Workspace owners can shorten this to as low as 7 days, or extend it up to 365 days. Derived analysis results follow the same retention as their source dataset.
- Export & right to erasureWorkspace owners can export all organisation data as a downloadable archive at any time. A one-click "Delete all organisation data" action permanently removes datasets, reports, evidence and storage objects, with an audit log entry recorded.
- PII minimisationYou control which columns you upload. We only need an opaque employee identifier and overtime transaction data — dates, hours, and monetary values. We do not need names, email addresses, dates of birth, bank account numbers, tax file numbers, or any other sensitive identifiers.
- Audit logEvery sensitive action — sign-in, dataset upload, report generation, member changes, data export, data deletion — is recorded in an append-only audit log visible to workspace owners.
Layer 03
Our service providers
Like every modern software service, OvertimeSolved relies on a small number of reputable companies for core infrastructure — hosting, database, and payments. Each provider is contractually bound to the same data protection standards we follow. We will tell workspace owners by email and update this page at least 30 days before any new provider is added.
Provider
Purpose
Region
Supabase
Managed Postgres database, authentication and object storage
Asia Pacific (Singapore)
Cloudflare
Edge hosting, TLS termination and DDoS protection for the web application
Global edge network
Stripe
Subscription billing and payment processing (no payroll data shared)
Global
Lovable
Application hosting platform and AI gateway
Global
Layer 04
DPA & legal
Data Processing Agreement (mandatory)
A Data Processing Agreement is mandatory for every workspace. The DPA names OvertimeSolved as Processor and your organisation as Controller, sets out processing instructions, service providers, security measures, and return/deletion at contract end. Workspace owners and admins can review and accept the current DPA from inside the application; acceptance is recorded with the user, version, date, IP address and user agent. No data may be uploaded until the DPA is accepted.
Non-disclosure
All OvertimeSolved personnel are bound by written confidentiality obligations that survive termination of their engagement. Per-workspace NDAs are available for enterprise customers on request.
Return & deletion at contract end
Within 30 days of subscription termination, all organisation data is permanently deleted from production systems. Backups are purged within a further 30 days. A written deletion certificate is available on request.
International transfers
Where data is transferred outside its primary region (for example to a US-based service provider for billing or edge delivery), we rely on the Standard Contractual Clauses approved by the European Commission and equivalent contractual safeguards for Australian and US-originating data, together with supplementary technical measures.
Layer 05
Compliance roadmap
We believe in being honest about where we are. Below is the current status of our compliance programme.
GDPR-aligned data processing
LiveRow-level security on all customer data
LiveEncryption in transit (TLS 1.2+) and at rest (AES-256)
LiveAudit logging of sensitive actions
LiveHosted on SOC 2 Type II and ISO 27001 certified infrastructure (AU, US, EU/UK privacy-law aligned)
LiveTOTP two-factor authentication
LiveConfigurable retention & one-click data export / deletion
LiveIndependent SOC 2 Type II attestation for OvertimeSolved (planned)
PlannedIndependent ISO 27001 certification for OvertimeSolved (planned)
PlannedSAML SSO for enterprise workspaces (planned)
PlannedIndependent annual penetration test (planned)
PlannedLayer 06
Vulnerability disclosure
If you believe you have found a security vulnerability in OvertimeSolved, please report it to us privately. We will acknowledge your report within 2 business days, keep you updated on progress, and credit you publicly once the issue is fixed (with your permission).
adrian@accordanalytics.com— please do not disclose publicly until we have responded.
Last reviewed June 2026.
Back to home