Security
Effective Date: July 2026
How Timestamp It is built, hosted, and protected. This page is maintained for customers and security reviewers. To report a suspected vulnerability, email team@timestampitapp.com.
1. Infrastructure & Hosting
- Timestamp It is delivered as a hosted service (SaaS). Nothing is installed on customer systems, and the product does not require any connection to a customer's internal network.
- Our database, file storage, authentication, and backend functions run on Supabase, hosted on Amazon Web Services in US East (Ohio), us-east-2.
- We operate a single production region. There are no database or storage replicas outside the United States.
- The application database is PostgreSQL. Physical and environmental security of the underlying data centers is inherited from AWS.
2. Encryption
- In transit: All client-to-server and server-to-server traffic uses TLS. The app does not transmit customer content over unencrypted channels.
- At rest: Databases, file storage, and backups are encrypted at rest by our infrastructure provider.
3. Access Control & Tenant Isolation
- Row-level security is enabled on every table in our production database. Authorization is enforced by the database itself, not only in application code, so an authenticated session can reach only its own rows and rows explicitly shared with it.
- Authenticated backend functions. Backend functions that return or modify customer data verify a valid session token before doing any work.
- Collaboration is explicit. Access to a project or team is granted only through an invitation or share link created by a user who already has access.
- Administrative access is limited and logged. We do not browse customer media. In narrow cases — a support request from the account holder, or investigation of a fault — an authorized administrator may access an account. Every such access is written to an immutable audit log.
- Secrets management. API keys and service credentials are held as server-side environment secrets and are never shipped in the mobile client.
4. Patching & Vulnerability Management
- Platform patching. The database engine, runtime, and underlying operating systems are patched by our infrastructure provider as part of their managed service.
- Application dependencies. Reviewed and updated on a ⚠ NEEDS INPUT: state your cadence — e.g. "monthly, and immediately for any advisory rated high or critical" basis.
- Critical vulnerabilities. Security fixes affecting customer data are prioritized ahead of feature work and released as soon as they are validated.
- Mobile releases. Client updates are distributed through the Apple App Store and Google Play and are subject to each store's review timeline.
5. Reporting a Vulnerability
We welcome reports from security researchers and customers. Email team@timestampitapp.com with enough detail to reproduce the issue. We will acknowledge your report and keep you informed as we investigate. Please do not publicly disclose an issue before we have had a reasonable opportunity to fix it, and please do not access, modify, or delete data belonging to other users while testing.
6. Incident Response
- On becoming aware of a security incident affecting customer data, we investigate to determine scope and impact, contain the issue, and remediate.
- We notify affected account holders by email ⚠ NEEDS INPUT: state your commitment — e.g. "without undue delay and in any case within 72 hours of confirming a breach", along with what we know about what was affected and what we are doing about it.
- Where a contract or applicable law imposes a shorter or more specific notification requirement, we follow that requirement.
7. Compliance Posture
We believe in being precise here rather than implying more than we hold. Timestamp It is built and operated by a small team, and we do not currently carry formal third-party certifications:
| Framework | Status | Notes |
|---|---|---|
| ISO 27001 | Not certified | No current certification or audit in progress. |
| SOC 2 Type II | Not certified | Our infrastructure provider maintains SOC 2; we do not hold our own report. |
| NIST CSF / SP 800-53 | Not certified | Not formally assessed. Our controls align with common practice in several areas but we make no conformance claim. |
| HIPAA | Not compliant | We are not a business associate and do not sign BAAs. Not for use with PHI. |
| PCI-DSS | Out of scope | We never receive or store cardholder data. Purchases run through the Apple App Store and Google Play. |
| CJIS | Not compliant | Not for use with Criminal Justice Information. |
| GDPR | Aligned | We support access, correction, deletion, and portability requests. Not separately certified. |
| CCPA / CPRA | Aligned | We do not sell or share personal information as those terms are defined. |
| FedRAMP | Not authorized | No FedRAMP authorization or agency sponsorship. |
If a certification is a hard requirement for your organization, contact us before purchase so we can tell you honestly whether we can meet it.
8. Data Residency & Transfer
- Stored in the US: Yes. All customer data resides in AWS us-east-2.
- Processed in the US: Yes.
- Transmitted outside the US: Not in the ordinary course. Content is served to the device that requests it, so a user who travels abroad will receive their own data at their location.
- At end of contract: You may export your projects at any time, and you may delete individual media, projects, or your entire account. On deletion, data is removed from active systems; residual copies in encrypted infrastructure backups age out on the ordinary backup rotation. See the Privacy Policy.
9. Subprocessors
We use a small, deliberately short list of third-party providers. Each one, what it handles, and where it operates is published at /subprocessors.
10. Availability, Backups & Support
- Availability. The service runs on managed cloud infrastructure with provider-level redundancy. We do not currently publish a contractual uptime guarantee for self-serve plans. ⚠ NEEDS INPUT: decide whether to offer a formal SLA — publish a number only if you intend to be bound by it
- Backups. The production database is backed up by our infrastructure provider on an automated schedule with point-in-time recovery available. ⚠ NEEDS INPUT: confirm your Supabase plan's retention window, e.g. "7 days"
- Support. Ongoing support is included at no additional cost for all plans. Reach us at team@timestampitapp.com. ⚠ NEEDS INPUT: state target response time and support hours, e.g. "next business day, Mon–Fri"
- Feature releases. New features ship continuously and are delivered through the app stores. ⚠ NEEDS INPUT: state a rough cadence, e.g. "roughly every 2–4 weeks"
- Implementation. No implementation project is required — users download the app and sign in. We assist teams with onboarding on request.
11. Compatibility
- iOS: ⚠ NEEDS INPUT: minimum supported iOS version
- Android: ⚠ NEEDS INPUT: minimum supported Android version
- Web: Our website supports current versions of Chrome, Safari, Edge, and Firefox on desktop and mobile.
- Windows 11 / Windows Server 2022 / 2025: Not applicable. Timestamp It is a mobile application with a web companion site; no Windows client or server component is installed.
- Microsoft Entra ID: Not currently supported. Sign-in is handled by our own authentication provider. ⚠ NEEDS INPUT: confirm which sign-in methods you offer, e.g. Apple, Google, email