Security and Data Protection in Time Tracking

Certified Data Centers in the EU

time cockpit uses the Microsoft Azure cloud to provide its services. It runs in data centers inside the European Union, in Amsterdam and Dublin. Microsoft has these data centers certified to ISO 27001, among other standards, and publishes the evidence in its Azure compliance offerings. Whether you book time in the browser on your PC or on your phone, your time tracking runs entirely in these data centers.

GDPR-Compliant Time Tracking

Anyone who runs employee time tracking processes personal data of their employees and is therefore subject to the General Data Protection Regulation (GDPR). time cockpit is operated in the EU, and we provide a data processing agreement (DPA).

For all services that time cockpit relies on, Microsoft offers the EU Standard Contractual Clauses (also known as EU Model Clauses). They are used in the agreements between Microsoft and us to ensure that any personal data leaving the European Economic Area (EEA) is transferred in compliance with the GDPR. Whether your time tracking as a whole is GDPR-compliant also depends on the legal basis, how you inform your employees, permissions and the retention rules in your company. How we handle your data on this website is described in our privacy statement.

Dedicated Database, Backups and Encryption

• A dedicated database per customer: From the first user on, every customer gets a database cluster of their own with three nodes. Your data is kept separate from other customers’ data.
• 35-day point-in-time recovery: Your database can be restored to any second within the last 35 days. Microsoft manages the backups redundantly in both European data centers.
• Encryption: All data is encrypted at rest and in transit using certificates managed by Microsoft.

The additional sandbox database of your own, a database in your own Azure subscription on request and single sign-on are covered on enterprise time tracking.

Who Can Access Your Data

In time cockpit, every user sees only what the permission system allows. The same permissions apply to every access from outside:

• Applications connect through the Web API with personal access tokens, always on behalf of a user and with that user’s permissions.
• AI assistants connect through the MCP server for AI assistants. Users sign in with their own Microsoft Entra ID account, the assistant sees nothing the user may not see, and every call is logged.
• With single sign-on through Microsoft Entra ID, your sign-in policies apply to time cockpit as well.
• time cockpit support accesses your database only at your request, for example to reproduce a reported error.

Platform-as-a-Service (PaaS)

Our cloud strategy is based on the Platform-as-a-Service (PaaS) model. This means that we do not rent virtual machines in the cloud and install our software on them. Instead, we use managed services provided by our cloud provider Microsoft. This allows us to focus on our core competencies, deliver a better product to our customers, and keep the costs for time cockpit low.

• Operating system patches and service packs are automatically maintained by Microsoft.
• All servers are implemented as multi-node clusters (e.g. web farms, database clusters).
• time cockpit is fully covered by the Azure Service Level Agreements provided by Microsoft.
• Firewalls and network components are provided by the Azure Platform and maintained by Microsoft.

Multi-Tenant From the Ground Up

time cockpit has been built from day one as a multi-tenant application. What customers share is the application layer: web servers and services that Microsoft runs as PaaS serve all customers. Your data, on the other hand, lives in your own database that belongs to your account alone. This split allows us to offer time cockpit at a very attractive price. Shared infrastructure does not mean a lack of flexibility either. On the contrary, being highly customizable is a differentiating factor for time cockpit.

• Low operational costs thanks to a shared application layer.
• Separate databases per customer keep our customers’ data securely apart.
• A single code base for all customers enables us to innovate quickly and deliver new features to all customers at the same time.
• High degree of flexibility for individual needs of customers as a core value proposition.

More Than 15 Years of Experience with Azure

We have been using Azure since the platform has existed. time cockpit, on the market since 2010, was one of the first SaaS solutions on Azure. Our CEO Rainer Stropek was one of the first experts worldwide to be awarded the title Microsoft Most Valuable Professional (MVP) for the Azure platform. Providing large-scale SaaS solutions on Azure has been our core competency for more than 15 years. This is what we do, this is what we are good at.