Access controls
Role-based access separates what administrators, managers and employees can see and change. People see and do only what their access allows.
Security
How TimmyHR protects your data.
Employee records are sensitive. This page says what is in place today, and only that.
How access works
From sign-in to the record
- Step 1
Sign in
With Google, or an email and password.
- Step 2
Two-factor
Two-factor authentication can be added to any account.
- Step 3
Role check
Role-based access: people see and do only what their access allows.
- Step 4
Audit trail
On Pro and Enterprise, changes are recorded with a timestamp and who made them.
What protects your data
Sign-in
Sign in with Google or with an email and password. Any account can add two-factor authentication.
Encryption
Traffic to TimmyHR is served over HTTPS, and our hosting and database providers encrypt stored data at rest. Passwords are never stored in readable form.
Audit trail
On the Pro and Enterprise plans, an audit trail records important changes to users, access, payroll and settings, each with a timestamp and the person who made it.
Hosting and backups
TimmyHR runs on managed cloud hosting. Our database provider keeps backups that can restore the database to an earlier point in time.
Timmy AI is off by default
Timmy AI is off until an admin turns it on, and the same switch turns it off again. While it is off, nothing is sent to any AI provider.
Data protection
We handle your employee data on your behalf. A Data Processing Agreement for EU and UK customers is available on request. The privacy policy lists the third parties that process data for us, including the ones behind Timmy Chat and Timmy AI.
Read how Timmy AI handles your content on the Timmy AI page, and the full list of third parties in the privacy policy.
Questions about security or data protection?
Contact us to request a Data Processing Agreement, ask a security or compliance question, or walk through the controls with your IT team.
