Security

1. Infrastructure & Hosting

• Timestamp It is delivered as a hosted service (SaaS). Nothing is installed on customer systems, and the product does not require any connection to a customer's internal network.
• Our database, authentication, and backend functions run on Supabase, hosted on Amazon Web Services in US East (Ohio), us-east-2.
• Photos and videos are stored on Backblaze B2 object storage in US West (Sacramento and Phoenix).
• Both are United States regions. There are no database or storage replicas outside the country.
• The application database is PostgreSQL. Physical and environmental security of the underlying data centers is inherited from AWS.

2. Encryption

• In transit: All client-to-server and server-to-server traffic uses TLS. The app does not transmit customer content over unencrypted channels.
• At rest: Databases, file storage, and backups are encrypted at rest by our infrastructure provider.

3. Access Control & Tenant Isolation

• Row-level security is enabled on every table in our production database. Authorization is enforced by the database itself, not only in application code, so an authenticated session can reach only its own rows and rows explicitly shared with it.
• Authenticated backend functions. Backend functions that return or modify customer data verify a valid session token before doing any work.
• Collaboration is explicit. Access to a project or team is granted only through an invitation or share link created by a user who already has access.
• Administrative access is limited and logged. We do not browse customer media. In narrow cases — a support request from the account holder, or investigation of a fault — an authorized administrator may access an account. Every such access is written to an immutable audit log.
• Secrets management. API keys and service credentials are held as server-side environment secrets and are never shipped in the mobile client.

4. Patching & Vulnerability Management

• Platform patching. The database engine, runtime, and underlying operating systems are patched by our infrastructure provider as part of their managed service.
• Application dependencies. Reviewed and updated on a quarterly basis.
• Critical vulnerabilities. Security fixes affecting customer data are prioritized ahead of feature work and released as soon as they are validated.
• Mobile releases. Client updates are distributed through the Apple App Store and Google Play and are subject to each store's review timeline.

5. Reporting a Vulnerability

We welcome reports from security researchers and customers. Email team@timestampitapp.com with enough detail to reproduce the issue. We will acknowledge your report and keep you informed as we investigate. Please do not publicly disclose an issue before we have had a reasonable opportunity to fix it, and please do not access, modify, or delete data belonging to other users while testing.

6. Incident Response

• On becoming aware of a security incident affecting customer data, we investigate to determine scope and impact, contain the issue, and remediate.
• We notify affected account holders by email without undue delay, and in any case within 72 hours of confirming a breach, along with what we know about what was affected and what we are doing about it.
• Where a contract or applicable law imposes a shorter or more specific notification requirement, we follow that requirement.

7. Compliance Posture

Timestamp It is built and operated by a small team. We would rather state our position precisely than imply more than we hold:

• Privacy law. We align with GDPR and CCPA/CPRA practice — we support access, correction, deletion, and portability requests, and we do not sell or share personal information as those laws define it.
• Certifications. We do not currently hold our own ISO 27001 or SOC 2 report. Our infrastructure provider maintains SOC 2 for the platform we run on, but we make no conformance claim of our own.
• Cardholder data. Out of scope entirely — purchases run through the Apple App Store and Google Play, and we never receive card data.
• Regulated records. The product is not designed or offered for protected health information, criminal justice information, or similar regulated categories.

If your organization has a specific framework requirement or a vendor security questionnaire to work through, email team@timestampitapp.com and we will answer it directly, including where the answer is no.

8. Data Residency & Transfer

• Stored in the US: Yes. Application data in AWS us-east-2, media on Backblaze B2 US West.
• Processed in the US: Yes.
• Transmitted outside the US: Not in the ordinary course. Content is served to the device that requests it, so a user who travels abroad will receive their own data at their location.
• At end of contract: You may export your projects at any time, and you may delete individual media, projects, or your entire account. On deletion, data is removed from active systems; residual copies in encrypted infrastructure backups age out on the ordinary backup rotation. See the Privacy Policy.

9. Subprocessors

We use a small, deliberately short list of third-party providers. Each one, what it handles, and where it operates is published at /subprocessors.

11. Compatibility

• iOS: iOS 16.0 and later, on iPhone and iPad.
• Android: Android 7.0 (API level 24) and later.
• Web: Our website supports current versions of Chrome, Safari, Edge, and Firefox on desktop and mobile.
• Windows 11 / Windows Server 2022 / 2025: Not applicable. Timestamp It is a mobile application with a web companion site; no Windows client or server component is installed.
• Sign-in methods: Sign in with Apple, Sign in with Google, email, or Microsoft Entra ID. Entra ID lets organizations that run Microsoft 365 use their existing directory accounts, so there are no separate credentials to provision or revoke.