This page describes the actual state of Timeveo’s security measures. It deliberately contains no assurances we cannot back up. The contractually binding version of these measures is Annex 1 of the Data Processing Agreement.
1. Infrastructure and hosting
The Timeveo application and its database run at a French hosting provider inside the European Union. DNS, access protection and delivery of the public pages run through Cloudflare. No production client data is processed outside the services named in the subprocessor list.
2. Encryption
- In transit: all traffic between browser, application and connected services runs over TLS. Requests over HTTP are redirected to HTTPS.
- Stored credentials: security-relevant secrets are additionally encrypted at the application layer, in particular the credentials for the technical security device, the keys for connected payment and fiscal services, and payment gateway configuration.
- Passwords: passwords are stored only as hashes (bcrypt), never in plain text.
3. Tenant separation
Timeveo is a multi-tenant application. Every record belongs to exactly one tenant, and access is restricted to the active tenant centrally at the data layer rather than in each individual query. That restriction is implemented as a shared building block of all data models and is covered by automated tests that flag any cross-tenant access as a failure.
4. Access control
- Role and permission based access control within each tenant; permissions can be granted per area.
- Two-factor authentication for platform accounts, configurable in the tenant’s security settings.
- Separate interfaces for platform operations and for tenants; access to platform-wide reporting is limited to explicitly authorised accounts.
- Rate limiting on sign-in and verification attempts to make automated attacks harder.
5. Logging and traceability
- Audit log: security and privacy relevant operations are logged with timestamp, acting account and affected record.
- Outbound API log: calls to external services are recorded together with their status code. Credentials and sensitive content are stripped according to a fixed rule before the entry is stored.
- Retention: logs and consent records are deleted automatically once their retention period expires.
6. Privacy tooling in the application
- Consent management with seven separate purposes (contractual data processing, email and SMS marketing, three cookie categories, third-party tracking). Grants and withdrawals are recorded with timestamp and origin.
- Access export for requests under Art. 15 GDPR. The exports reach across the application, covering appointments, customer data, payments, gift cards, reviews, notifications and form submissions, among others.
- Erasure functions covering the same scope, removing or irreversibly redacting data in every affected area.
7. Point-of-sale compliance
When the point-of-sale functions are used, till transactions are signed by a certified cloud TSE under the German KassenSichV. Export to DSFinV-K for tax audits is built in. The business’s own tax duties, including registering the till with the tax office, remain with the tenant.
8. Development and change management
Changes to the application are version controlled, reviewed by a second pair of eyes, and covered by an automated test suite that must pass in full before anything is merged into the main branch. Static analysis at a high strictness level runs across the domain modules in addition.
9. Reporting vulnerabilities
Report suspected vulnerabilities to security@timeveo.com. Please describe the affected area and the steps to reproduce, and do not publish the finding before it is fixed. We confirm receipt and come back to you with an assessment. There is currently no bug bounty programme.
10. Certifications
Timeveo currently holds no formal security certifications such as ISO 27001 or SOC 2. The measures are aligned with Art. 32 GDPR. We list only what is actually implemented.
11. Open items
The backup and restore concept is being documented and will be added to the next version of this page with concrete intervals.
Version 1.0, effective 20 August 2026.