Is Time Out Zone SOC 2 certified?

Not yet. A SOC 2 audit is planned, not something we claim today. What you can verify now: the security practices above, the subprocessor list, and the audit trail in your own account.

Where is my data stored?

In Frankfurt, Germany: database, backups, and files in Supabase's eu-central-1 region, compute in Vercel's fra1 region. The GDPR article covers residency in detail.

Who inside my company can see health-related leave?

Colleagues see that someone is away, not why. Leave types, notes, and attachments follow role permissions: managers see their scope, admins the company. See the sick leave article for the privacy specifics.

Security overview

Absence data is HR data: who is sick, who is on parental leave, who has a doctor's note attached. This page summarizes how Time Out Zone protects it: sign-in, tenant isolation, files, encryption, and accountability.

The short version: authentication through Clerk, every server operation checked for both permission and company, private file storage with expiring links, and an append-only audit trail.

Sign-in and sessions

Authentication is handled by Clerk, a dedicated identity provider. Time Out Zone never sees or stores your password.
Sessions last at most 7 days and expire after 1 day of inactivity.
Multi-factor options are supported through Clerk; companies using SSO typically enforce MFA in their own identity provider.

Tenant isolation

Time Out Zone is multi-tenant, and isolation is enforced where it counts: every server operation runs through a permission check that also scopes the query to your company. There is no code path that reads another tenant's data, and automated tests exercise the cross-tenant boundaries.

Files and encryption

Profile documents and request attachments live in private storage buckets, never on public URLs.
Files are served through short-lived signed links, with file-type and size checks on upload.
Data is encrypted in transit (TLS) and at rest (AES-256 via the hosting infrastructure).
Card data never touches Time Out Zone servers: payments run entirely through Stripe.

Accountability and abuse protection

Every change is written to an append-only audit trail. See the audit trail article for the full tour.
Expensive operations such as invitations, report generation, and data exports are rate-limited.
Hosting runs on Vercel (Frankfurt) and Supabase (eu-central-1); subprocessors are listed openly, including the US-based ones: Clerk, Stripe, Resend, and Sentry.

Audit Log panel showing the company-wide compliance trail

Frequently asked questions

Is Time Out Zone SOC 2 certified?: Not yet. A SOC 2 audit is planned, not something we claim today. What you can verify now: the security practices above, the subprocessor list, and the audit trail in your own account.
Where is my data stored?: In Frankfurt, Germany: database, backups, and files in Supabase's eu-central-1 region, compute in Vercel's fra1 region. The GDPR article covers residency in detail.
Who inside my company can see health-related leave?: Colleagues see that someone is away, not why. Leave types, notes, and attachments follow role permissions: managers see their scope, admins the company. See the sick leave article for the privacy specifics.