Kordano

Security at Kordano

Last reviewed: 26 October 2026 · Kordano LLC

Kordano Time sees how your team spends its working hours. That is sensitive, and we treat it that way. This page explains, in plain words, how we protect your company's data, what we never collect, and what you control. If anything here is unclear, write to [email protected] and a person will answer.

We update this page whenever a control changes.

What we collect and what we do not

  • No keystroke logging. The desktop app counts keystrokes and mouse movement to measure activity. It does not record which keys were pressed. Configured screenshots and screen recordings can contain text visible on your screen.
  • No microphone or webcam recording on computers. Configured screenshots and screen recordings capture on-screen content. Clock-in photo and location checks are not currently available on the live service; feature-specific notices and permissions will apply before they are released and enabled.
  • No clipboard access or reading other apps’ stored passwords, messages or device files. Configured screen captures may contain visible messages or other sensitive information. Browser Helper reads page titles, URLs and supported task details, which can include email subjects or conversation names. See our Privacy Policy.
  • Tracking and Browser Helper have different controls. Screenshot capture runs while a timer or shift is running. Browser Helper sends active-tab information while the browser is open, and the desktop app may retain local website-activity records while no timer is running. Our Privacy Policy explains the information handled and the upcoming privacy-control update.

Encryption

  • In transit: every connection to Kordano uses HTTPS with TLS 1.2 or newer. Older protocols are refused. Browsers are told to use HTTPS for two years (HSTS with preload), to help prevent protocol downgrades.
  • Screenshots and photos: stored in private object storage that has no public address. Each image is served through a signed link that expires after 5 minutes. Uploads use a signed link that expires after 90 seconds and can write to one file only. The storage provider encrypts every object with AES-256.
  • Backups: every database backup is encrypted with age (X25519 key exchange, ChaCha20-Poly1305) before it leaves the server. The private key is held offline and is never on a server.
  • Passwords and codes: passwords are stored only as bcrypt hashes. Two-factor backup codes and emailed sign-in codes are stored as hashes and work once.
  • Database at rest: database volumes are encrypted at the disk level, so a removed or decommissioned drive holds nothing readable.

Signing in and access

  • Two-factor authentication with any authenticator app (TOTP) plus printed backup codes. A company owner can require it for every member. It applies on the web, the desktop app and the phone app; there is no sign-in path that skips it.
  • Rate limits and lockouts on every sign-in and code entry.
  • Roles: owner, admin, manager and member. People see only the teams and projects their role allows.
  • Company isolation: every request checks which company you belong to before any data is read or written. A dedicated suite of automated tests checks cross-company access before every release.
  • Phone app sessions use the OAuth PKCE flow. Access tokens expire after 15 minutes and are kept in memory only. Refresh tokens are rotated on every use; if an old one is ever replayed, the whole session family is revoked and the user signs in again.
  • Optional IP allowlist per company, for teams that work from fixed locations.

Where your data lives

Kordano Time runs on servers in Vienna, Austria, inside the European Union, on hardware dedicated to Kordano and not shared with other companies. All traffic passes through Cloudflare, and the servers accept web traffic only from Cloudflare's network, so they cannot be reached directly from the internet. A separate staging environment in Germany, with its own database, is where every release is tested before it reaches you.

Monitoring you can see

Time tracking only works when the people being tracked trust it. So:

  • Every member sees exactly what the app collects about them, in the app, in the same words their manager sees.
  • Companies choose whether screenshots are taken at all, how often, whether they are blurred on the device before upload, and how long they are kept (90 days by default).
  • Blurring happens on the person's computer. A blurred screenshot is never stored unblurred anywhere.
  • A member can delete a screenshot taken in error, and the deletion is recorded.

Software you can trust

  • Signed apps. The Mac app is signed with our Apple Developer ID and notarized by Apple. The Windows app is signed by Kordano LLC through Azure Artifact Signing with a timestamp. An unsigned build cannot be published. Linux packages carry a SHA-256 checksum.
  • Verified updates. The app checks the SHA-256 of every update it downloads against our release record before installing it.
  • Gated releases. Every change passes an automated build, test and sign-in check, is reviewed on a development environment, then on staging, and only then is the exact tested build promoted to production. Production is never built in place. Database changes at release time are add-only; anything destructive is refused by the release gate. Every release can be rolled back with one command.
  • Dependencies are updated through automated pull requests and checked against known-vulnerability databases.

Backups and availability

  • A full database backup every night, kept on the server, on a second machine in another location, and in encrypted object storage. Restores are tested, not assumed.
  • A snapshot is taken before every production release.
  • Production and staging use separate machines and separate databases.
  • Incident response: if we ever confirm a breach that affects your data, we will tell affected customers without undue delay and within 72 hours of confirming it, or sooner where applicable law requires, with what happened, what was affected and what we did.

Payments

Paid checkout is not currently available. When subscriptions launch, we plan to use a payment provider’s hosted checkout so card details are entered with the provider rather than sent to or stored by Kordano. We will update this section when billing is available.

Your rights and controls

  • Export your company's time, project and report data at any time.
  • Deletion controls cover members, projects and the workspace. Deletion, cancellation, legal holds, customer-controlled copies and backup expiry follow the rules in our Privacy Policy and Terms.
  • Retention settings are available for screenshots. Clock-in evidence is not currently available on the live service; its future retention rules are described in our Privacy Policy.
  • Data processing: For workspace data, Kordano acts on your organization’s instructions. If your use requires a data-processing agreement, contact [email protected] to arrange it before that processing starts. This requirement is not limited to an enterprise plan.

Where we are on certifications

Today Kordano holds no third-party security certification. Our next steps include an independent penetration test with a published summary and a public vulnerability-disclosure policy. We will update this section as independent assessments and certifications are completed.

Frequently asked questions

Can my employer see what I type?

The activity counter does not record which keys you press. However, screenshots and screen recordings, where enabled, can contain text visible on your screen. Browser Helper can also read page titles and supported task details as explained in our Privacy Policy.

Are screenshots taken when I am not working?

No. Capture runs only while a timer or shift is running, and you can see when that is. Your company decides whether screenshots are taken at all, how often, whether they are blurred before upload, and how long they are kept.

Who at Kordano can see my company's data?

A small number of Kordano engineers, only to resolve a support request, and every such access is recorded in an audit log. We never browse customer data to build features.

Where is my data stored?

On dedicated servers in Vienna, Austria, inside the EU. Backups are encrypted before they leave the server.

Is everything encrypted?

In transit, always (TLS 1.2+). Screenshots and backups, yes (AES-256 by the storage provider; age for backups). Passwords and codes are stored as hashes only. The database itself sits on an encrypted volume whose key is never stored on the same machine.

Do you hold a third-party security certification?

Not yet. We publish where we stand on this page instead of implying a badge. Our next step is an independent penetration test with a public summary.

Can I require two-factor sign-in for my whole team?

Yes. A company owner can require it for every member. It applies on web, desktop and phone with no exceptions.

How long are screenshots kept?

90 days by default. Your company can shorten or lengthen that. Deleted screenshots are removed from storage.

How long will face-verification photos be kept?

Face verification is not currently available on the live service. At launch, the encrypted reference photo will be kept only while authorized face verification is needed, with deletion when consent is withdrawn, the organization records the person as having left or removes them, the relevant account is deleted, or verification is no longer needed. A fixed period alone will not require a new photo. Clock-in/out selfies will be cleared after the check; incomplete captures will expire and be cleared through cleanup. These are separate from screenshot retention. See the Privacy Policy for the planned rules and separate backup and preservation provisions.

What happens when I delete a member, or the company?

Deletion and cancellation are different actions. Removing a member, a project or a workspace follows the applicable deletion rules and legal requirements. When paid workspace access ends, the Owner has a 30-day export window before online workspace removal, unless paid access resumes or a legal hold applies. Backups expire separately; removal records are reapplied after a restore. Customer-controlled copies and legally required billing records are separate. See our Privacy Policy and Terms.

Do you sell data or use it to train AI models?

No, and no. If you connect an AI assistant to Kordano through our MCP integration, it reads only what you authorize, through a token you can revoke at any time, and we keep a log of what it asked for.

Do you support single sign-on (SAML, Okta, Google Workspace)?

Not yet. It is on the roadmap for the enterprise plan.

Do you offer a data-processing agreement?

A standard data-processing agreement is not yet available. If your organization requires one, contact [email protected] before using Kordano for that processing. This is not limited to an enterprise plan. Our Privacy Policy and Terms do not replace a required data-processing agreement.

How do I report a vulnerability?

Email [email protected]. We acknowledge within 2 business days and will not pursue good-faith researchers.

Report a security issue

If you believe you have found a vulnerability, email [email protected]. We acknowledge every report within 2 business days and tell you what we found and fixed. We will not take legal action against good-faith research that respects other customers' data. Our security.txt is at kordano.com/.well-known/security.txt.