Security

1. How Data Is Protected

• Encryption in transit: every connection to the Service uses HTTPS.
• Separation between companies: every request is checked on the server against the person's company and role, so one company cannot read another's data.
• Roles: owners and Admins choose who sees what (Viewer, Editor, Admin), and sensitive actions need the right role.
• Private files: clock-in photos, signatures and identity documents are stored privately and opened only through short-lived links.
• Links without an account (clock-in, approvals, payments) are long random credentials that can be revoked or expire, and are limited to what they were issued for.
• Limits on repeated attempts, and records of security-relevant events, to detect and stop abuse.
• A deletion grace period, so an account or company deleted by mistake can be recovered for a limited time.

2. What You Can Do

• Use a unique password and do not share your sign-in details.
• Share a worker's or a client's link only with that person, and revoke it if it is lost.
• Review your company's members and roles from time to time, and remove those who no longer need access.

3. Reporting a Vulnerability

If you believe you have found a security vulnerability, write to zeropresu@mazestudio.design with a description and the steps to reproduce it. Please do not access, change or delete data that is not yours, do not disrupt the Service, and give us reasonable time to fix the issue before disclosing it. We will acknowledge your report, keep you informed, and not take action against good-faith research that follows these rules.

4. Incidents

If a security incident affects personal data, we will inform the companies affected and the authority as Ley 81 de 2019 and its regulation require.

Changes