Hourlify

Security

How we protect your account and data.

These are the safeguards that exist in the product today. We would rather list a few things that are true than many that are vague.

Safeguards

Sign-in and sessions

  • Passwords are stored as one-way hashes, never in readable form
  • A password policy is enforced when passwords are set
  • Repeated failed sign-ins temporarily lock the account, and sign-in attempts are rate limited
  • Sessions use short-lived tokens, with the longer-lived part kept in a cookie that scripts on the page cannot read

Access and separation

  • Role-based access: administrators, people managers, project managers, delivery managers and team members see and do only what their role allows
  • Managers see the people they manage, and project managers see their projects
  • Your organisation’s data is kept separate from every other organisation’s

Integrity of your numbers

  • Team members and managers cannot approve their own time; only an administrator can
  • Time that is on an invoice is locked, so billed hours cannot be edited or reopened
  • Changes to submitted time are recorded in a history

Payments

  • Card payments are handled by Stripe. Card details never touch our servers
  • You can manage your subscription, payment method and invoices from your account

Where it is hosted

The service and its data are hosted on servers in the United Kingdom.

Found a security issue?

Please tell us at security@hourlify.co.uk. Include enough detail for us to reproduce it. We will acknowledge your report and keep you informed, and we ask that you give us reasonable time to fix a problem before you share it publicly.