# Security and privacy | ClockAssist Time Tracking Software > How ClockAssist secures your data: ISO 27001, a data centre in Amsterdam, 99.9% uptime, privacy by design and full GDPR compliance. No storage outside the EEA. Source: https://clockassist.ai/en/security-and-privacy [Home](https://clockassist.ai/en) → Security & Privacy # Security & Privacy Securing the data we hold about you, and the data you process with ClockAssist, is our highest priority. We take appropriate measures to make sure nobody can access your data without the right to, and we demand the same of our partners and suppliers. ISO 27001 certified 99.9% uptime GDPR compliant EU data centre (Amsterdam) This statement may be updated from time to time. Please check it regularly to stay up to date with the latest version. On this page - Definitions - Security - Privacy - Personal data - Terms Questions from your DPO or IT? E-mail [info@clockassist.com](mailto:info@clockassist.com) or call [+31 10 - 34 00 433](tel:+31103400433). Glossary ## The terms we use Below we explain which measures and methods we use and how your privacy is arranged at ClockAssist. First, a few terms we use in this statement: User Someone who has their own login details for ClockAssist and processes data with it. Admin A designated user who can receive day overviews when other users submit their day. System administrator / IT staff An employee of an organisation working with ClockAssist who is responsible for the correct installation of the software. The software The ClockAssist platform, which can be used on the computer itself, online and on a mobile phone. Submitting a day overview A user clicking the Submit button after reviewing and, where needed, adjusting their own day overview, understanding that the data from the day overview then becomes visible to the relevant admin within the organisation the user works for. Security ## How we secure your data ### Hosting and server management ClockAssist uses managed hosting on its own servers, run in a data centre in Amsterdam. The following certifications and quality marks apply: ISO 27001 PCI DSS SOC1 HIPAA NEN 7510 All connections to the server are encrypted in transit. The data processed in ClockAssist is stored securely in the data centre in Amsterdam. No ClockAssist data is stored or processed outside the European Union and the European Economic Area. ### Password management and 2FA ClockAssist does not store user passwords as text. We only keep password hashes that cannot be deciphered, encrypted with Bcrypt. On top of the measures we take to protect your data and account, it's wise to choose a strong password yourself (the longer, the safer) and to set up two-factor authentication (2FA). Without your mobile phone, nobody can then log in to your account. ### Availability ClockAssist has an uptime of 99.9%: the software almost never has an outage and is almost always available. If there is an outage, our Development team is notified automatically and we do everything we can to make the platform available again. Our current availability is public on the [status page](https://stats.uptimerobot.com/13AOkSpN1r). Privacy ## Privacy by design, not a monitoring tool ### Privacy by design Your privacy within ClockAssist is of the utmost importance to us. ClockAssist is built on the concept of privacy by design. This means that, by definition, all of a user's data can only be viewed by that user, until the user gives permission to share certain data. ### The user's privacy ClockAssist recognises and registers activity on your computer or phone. We are aware that passing this data on to anyone other than you, whether a colleague, an application, or a report that can be traced back to an individual user, is not ethical. In fact, we believe it shouldn't be allowed. That's why we built the software so that the user has full freedom to: - review the registered data themselves first, - adjust it themselves first, - complete it themselves first, and - submit it themselves, making the data visible to the relevant admin within the organisation. By upholding privacy by design, it is impossible for users to view another user's data, whatever level they operate at within the software (admin, user or system administrator/IT staff). Impossible, unless that user chooses to submit their day overview. After submission, the day overview data goes to the admin responsible for time registration and/or invoicing within the organisation. In summary, this is what we can say about your privacy within ClockAssist: Other users cannot see your data, unless you have submitted your day, then the relevant admin can see your day overview. You can always check, adjust and complete your day overview first, without any other user knowing or seeing it. Reports are always organisation-wide and can never be traced back to a specific user. (ClockAssist is not responsible if information from a report can be traced back to a specific user when that user is the only person in the organisation who, by role, performs a certain activity.) Personal data ## Processing personal data ### Data we process ClockAssist processes no personal data other than an e-mail address, first and last name and a business phone number. This data is only used for the software to work correctly: logging in and linking the right logs to the right user. We do not process any special categories of personal data. We also use the e-mail address to send you product-related information, such as instructions and tips for using ClockAssist. You can always unsubscribe from these e-mails. Because you also process client data with our software, we are required to sign a data processing agreement with all our clients. Inside the software you can read, sign and download this agreement. ### Transfer of personal data ClockAssist does not pass personal data on to third parties. Nor do we process or store data outside the European Economic Area. We do use applications that enable us to communicate with our clients and store client information: #### Intercom Client communication, chatbot and CRM functionality. #### Mailgun E-mail communication with clients, such as password resets. These applications are international in nature. According to the European Commission, the destination country offers an adequate level of protection, or the supplier is certified under the EU-US Data Privacy Framework. ### Retention period of personal data ClockAssist never keeps your personal data longer than necessary, unless the law justifies or requires a longer retention period. By 'necessary' we mean: as long as needed to guarantee the software works correctly. ### Your rights - Access: you always have the right to access the personal data we keep about you. - Rectification: you have the right to have your personal data corrected, completed or updated. You change this data yourself in your own account; you are responsible for keeping it correct. - Withdrawing consent: you have the right to withdraw your consent to the processing of your personal data. By doing so you also agree that you can no longer use ClockAssist. - Data portability: you have the right to request your personal data and receive it in a common format. You can exercise your rights by sending an e-mail to [info@clockassist.com](mailto:info@clockassist.com). We will handle your request as soon as possible, and in any case within four weeks. To fulfil your request we need confirmation of your identity, so always include a copy of your ID. Terms ## Terms and conditions Our terms and conditions apply to the use of ClockAssist. The full legal text has not yet been migrated to this website; you can request the current version, as well as our privacy statement and the cookie policy for the website, free of charge via [support@clockassist.com](mailto:support@clockassist.com). The data processing agreement we sign with all our clients is available directly inside the software, where you can read, sign and download it.