Security Addendum
Security for workforce
data, records, and trust
ZoikoTime is designed with layered security, governed access, audit-ready records, data-protection controls, and enterprise review support for organizations that rely on workforce intelligence.
ZoikoTime helps organizations manage sensitive workforce information—time records, activity signals, reports, screenshots where enabled, user roles, organizational settings, and evidence records. Security is built into how the platform manages access, data, auditability, and operational controls.
ZoikoTime is a platform of Zoiko Tech Inc., a technology subsidiary of Zoiko Group Inc.
Security at a glance
At a glance
Role-based access controlEncryption & data protectionAudit logs & evidence integrityAdministrative controlsData retention governanceLegal hold supportSecure product practicesEnterprise review supportOverview
Security built around workforce evidence
ZoikoTime protects the workforce records and operational data customers use for management, reporting, billing and payroll support, compliance review, dispute handling, and internal governance.
Access governance
Users should only access the data, records, settings, reports, and workflows appropriate to their role, permissions, organization, and configuration.
Data protection
Customer data is protected through secure transmission, controlled storage, data-handling safeguards, and administrative controls.
Auditability
Important actions are logged to support accountability, investigation, evidence review, and administrative oversight.
Configuration control
Administrators control settings for users, roles, policies, data access, exports, screenshots, retention, and workspace governance where supported.
Operational security
Platform operations include monitoring, controlled changes, incident handling, and security review appropriate for a commercial SaaS environment.
Enterprise review
Enterprise customers have a clear route to request available security information through sales, legal, and procurement workflows.
What We Protect
Data ZoikoTime protects
Categories of customer and workforce-related data may vary by plan, configuration, integrations, jurisdiction, enabled features, and user activity.
Account data
Examples
Names, emails, roles, user profiles
Security consideration
Identity, account administration, access control
Organization data
Examples
Company profile, departments, teams, policies, settings
Security consideration
Tenant separation, configuration governance
Time records
Examples
Clock-in/out, breaks, timesheets, approvals
Security consideration
Integrity, auditability, export controls
Activity signals
Examples
App/URL activity, idle time, work-session data where enabled
Security consideration
Policy-based access, transparency, retention controls
Screenshots
Examples
Screenshots where enabled by customer policy
Security consideration
Redaction, access control, storage, retention
Reports
Examples
Workforce analytics, productivity, attendance reports
Security consideration
Permissioning, export governance, audit logs
Evidence records
Examples
Evidence packages, review records, exception history
Security consideration
Integrity, legal hold, chain-of-custody support
Billing data
Examples
Plan, subscription, invoice, account details
Security consideration
Restricted access, payment-provider boundaries
Integration data
Examples
Data exchanged with payroll, HR, PM, identity, billing systems
Security consideration
API security, permissions, integration controls
The exact data processed depends on customer configuration, enabled modules, user roles, plan, integrations, and applicable agreements.
Access control and identity
ZoikoTime supports role-based access, administrative controls, and account
safeguards to help customers manage who can view, configure, export, or act
on sensitive workforce information.
Role-based access control
Administrators, managers, workers, finance, HR, legal, and
support users can be assigned appropriate permissions.
Administrative permissions
Customer administrators control user invitations, roles,
departments, policies, report access, and configuration settings.
Worker-level visibility
Workers have appropriate visibility into their own records,
transparency notices, and support routes.
Enterprise identity support
Enterprise plans may support SSO, SAML, SCIM, or related
identity-management capabilities where available.
Session & account controls
Secure authentication flows, session controls, password
policies, and administrative account management.
Least-privilege access
Access follows least-privilege principles so users and operators
only receive access appropriate to their role and purpose.
Encryption and data protection
Controls may vary by plan, deployment model, product feature, integration, and customer agreement.
Encryption in transit
Secure transmission methods protect data moving between users, browsers, mobile apps, APIs, integrations, and platform services.
Encryption at rest
Stored customer data is protected using appropriate encryption or equivalent safeguards where supported by the architecture.
Tenant separation
Customer environments and data are logically separated to help prevent unauthorized cross-organization access.
Secure APIs
APIs and integrations use appropriate authentication, authorization, rate controls, logging, and validation.
Data minimization
Data is collected and processed in ways tied to product purpose, configuration, workforce governance, and settings.
Screenshot protection
Where enabled, ZoikoTime supports redaction, access controls, transparency, retention settings, and policy-based governance.
Auditability, retention, and evidence integrity
Security supports more than account protection — it supports trustworthy records, accountability, evidence review, retention governance, and legal defensibility.
Audit logs
Important actions are logged to support accountability, administrative review, security investigation, and evidence traceability.
Record integrity
Time records, approvals, exceptions, reports, and evidence packages are handled to support traceability and reduce unauthorized alteration.
Evidence packages
Where supported, ZoikoTime helps customers compile workforce evidence for review, billing support, dispute handling, or legal processes.
Legal hold
Legal hold workflows help preserve relevant records when customers need to prevent deletion due to investigation, dispute, audit, or regulatory review.
Retention controls
Retention may vary by plan, settings, jurisdiction, module, legal hold status, and customer agreement.
Deletion & export governance
Deletion, export, restriction, and preservation are governed by role permissions, configuration, settings, and applicable terms.
Platform security and monitoring
Secure product development, controlled operations, monitoring, vulnerability management, and incident response appropriate for an enterprise SaaS platform.
Secure development
Secure development practices, code review, testing, dependency review, and controlled release processes.
Vulnerability management
Security issues are assessed, prioritized, remediated, and tracked through product and engineering workflows.
Monitoring & alerting
Operational monitoring supports platform reliability, security review, performance visibility, and issue escalation.
Incident response
Processes for identifying, investigating, escalating, and communicating security or availability incidents where applicable.
Backup & recovery
Backup and recovery practices support data availability, resilience, and operational continuity.
Third-party providers
Vendor use for infrastructure, payment, identity, analytics, or support is reviewed and governed by internal risk processes.
Customer responsibilities
Security is strongest when ZoikoTime and its customers work together.
Security review for procurement
Enterprise customers may require additional security information for procurement, vendor risk review, legal review, privacy review, or implementation planning.
Security questionnaires
ZoikoTime may support security questionnaires for qualified enterprise opportunities.
Documentation requests
Available security, privacy, data-protection, and product-governance documentation may be provided through appropriate channels.
Contractual security terms
Provisions may sit within an order form, Master Subscription Agreement, Data Processing Addendum, or related documents.
Procurement review
Support for procurement teams reviewing access control, data handling, retention, legal hold, incident response, and integrations.
Responsible disclosure. ZoikoTime avoids publishing sensitive technical details such as exact infrastructure topology, internal security tooling, vulnerability timelines, or detailed control mappings. Some materials are shared only under appropriate confidentiality or contractual review.
Security Addendum FAQs
Need security information for enterprise
review?
ZoikoTime can support qualified security, procurement, legal, privacy, and implementation reviews through the enterprise sales process.