Least privilege, deny by default
Access is granted by explicit intersection, not inherited by seniority or role name.
Security
Protect workforce records without turning work into surveillance
Identity and access, encryption in transit and at rest, environment and tenant boundaries, change control, monitoring, incident response, evidence, human authority, and a clearly stated split of responsibility between ZoikoTime, your organization, and your providers.
.png)
Security without hidden observation
No screenshots, keystroke content, URL history, application-name monitoring, or clipboard collection under any tier or configuration.
Security telemetry covers approved identity, access, change, source-health, service, and incident events. It does not cover what a person types, reads, visits, or copies. Security logs are operational records — they are not worker-behavior scoring, and no administrator setting turns them into one.
Six Operating Rules Behind Every Control
Principles are not certifications. They describe how the controls below are designed — nothing more.
Purpose limitation & minimization
Collect and retain only what the stated purpose requires. Restricted data stays out of ordinary logs and analytics.
Explicit scope
Tenant, entity, object, source, and action scope are stated rather than assumed.
Human authority
Consequential review stays with authorized people. Automation assists; it does not conclude.
Versioned change & correction
Changes carry versions and evidence. Corrections are recorded, not overwritten.
Secure defaults, transparent configuration
Defaults are safe, and what your administrators can change is visible to them.
How Identities Enter Scope, and What They May Do
Effective access is a deny-by-default intersection of role, tenant, entity, object, source, policy, and action. One role never grants unrestricted data access.
Identity & authentication
CurrentObjective:Ensure human, administrator, and service identities are verified before entering scope, and can be revoked.
- Scope
- Human users, administrators, service identities · production
- Summary
- Session creation, renewal, expiration, revocation, and risk response. Directory provisioning and deprovisioning where supported.
- Owner
- Security · reviewed by Platform
- Last reviewed
- 01 Jul 2026 · next 01 Jan 2027
Depends on:your identity provider, your user lifecycle process.
Limitations:Identity-provider integrations and authentication methods are stated per deployment. We do not claim phishing resistance, passwordless support, or specific SSO standards on this page — those are confirmed against your configuration. Recovery secrets and bypass methods are never published.
Authorization & administrative access
CurrentObjective:Prevent access beyond an explicitly granted intersection, and make privileged action attributable.
- Scope
- All roles and administrative functions
- Summary
- Separate view, create, edit, approve, export, configure, and administer permissions. Sensitive configuration changes may require review or dual control where supported.
- Owner
- Security · reviewed by Product governance
- Last reviewed
- 01 Jul 2026
You can inspect:effective permissions and their dependencies, where available.
Limitations:Dual control availability varies by function. There is no hidden super-admin and no unlogged emergency access — break-glass access requires a named authority, a stated reason, a time limit, and an audit record.
Data classification, minimization & protection
CurrentObjective:Categorize data by sensitivity and protect it appropriately in transit and at rest.
- Scope
- Approved data categories · production
- Summary
- Collection and storage minimization; protection in transit and at rest; key and secret lifecycle governance; backup, export, temporary-data, and deletion treatment.
- Owner
- Security · reviewed by Privacy
- Last reviewed
- 01 Jul 2026
Limitations:Algorithms, key lengths, rotation intervals, and vault topology are not published here — that detail routes through controlled review. Security protection does not replace privacy purpose, retention, or rights analysis; see Privacy.
Tenant, entity, environment & region boundaries
Partially implementedObjective:Keep organization, entity, and environment scope separated, and govern any movement across them.
- Scope
- Tenant and organization context; entity, jurisdiction, and policy scope; production, testing, and development separation
- Summary
- Customer-specific configuration and data boundaries; provider and region dependencies; cross-region or cross-entity movement requires governed rules and evidence.
- Owner
- Platform · reviewed by Security
- Last reviewed
- 28 Jun 2026
Partially implemented — stated scope:Environment separation and tenant context are current across all supported regions. Region-specific isolation guarantees are not claimed. We do not assert physical isolation or universal residency. Data location and residency is assessed region by region and remains a separate evidence-gated destination.
Secure development & change control
CurrentObjective:Ensure changes reach production only through accountable gates, and can be reversed.
- Scope
- Application, configuration, and infrastructure change
- Summary
- Security requirements and threat-informed design review where appropriate; code and change review; test and dependency checks; release approval, deployment identity, and environment scope; configuration and infrastructure change history; rollback, emergency change, and retrospective review.
- Owner
- Engineering · reviewed by Security
- Last reviewed
- 15 Jun 2026
Limitations:Some release gates are automated and evidenced rather than manually approved — we do not claim every change receives individual human sign-off, because that would be false. Repositories, tooling, and architecture detail are not published.
Logging, monitoring & source health
CurrentObjective:Detect and investigate security-relevant events without surveillance overreach.
- Categories logged
- Identity, access, configuration, service, source-health, and security events
- Summary
- Purpose, retention, access, and minimization apply to logs. Alerts have named ownership, triage, and escalation. Clock, source, and integrity context is preserved where relevant.
- Owner
- Security
- Last reviewed
- 01 Jul 2026
Limitations:We make no promise of complete detection — coverage is not measured to a published standard. Monitoring gaps and source failure produce visible uncertainty rather than silent assumption; see how that surfaces on System Status.
Never in security telemetry
Application-name monitoring, URL history, or keystroke content. Sensitive payloads and the prohibited surveillance categories are excluded from logs by design, not by configuration.
Response, Disclosure, and What We Will Not Promise
Incident response
CurrentPreparation, detection, triage, containment, recovery, and review. Severity and decision authority are defined internally; public summaries stay safe and accurate.
- Current state
- System Status is authoritative
- Notification
- Follows approved contractual, legal, and operational criteria
- Owner
- Security
Limitations:No guaranteed notification or recovery time unless contractually approved for your agreement. No public incident detail that would increase risk.
Vulnerability reporting
CurrentA public reporting route with triage, validation, severity assignment, ownership, and remediation states. Duplicate, non-actionable, out-of-scope, and unsafe disclosures are handled explicitly.
- Report to
- Security reporting route
- Do not include
- Credentials, worker data, or unnecessary sensitive detail
Limitations:No bounty, safe-harbor terms, acknowledgement, or remediation timeframe is promised on this page — none of those is currently approved. Live vulnerabilities and exploit detail are never published.
Backup, recovery & continuity
Under reviewAccess, encryption, integrity, and restoration testing are governed. Dependency, provider, and region considerations are explicit.
- Restoration
- Does not silently overwrite current evidence or audit history
- Owner
- Platform · reviewed by Security
Under review:Wording and scope are being reassessed, so this summary should not be relied on as settled. RPO, RTO, and availability figures are not published without maintained evidence and contract scope — Platform Reliability remains a separate, evidence-gated destination.
External Systems Are a
Controlled Dependency
Provider controls are provider controls. We do not present them as ZoikoTime controls, and we do not inherit assurance from a vendor's certifications.
Provider record— purpose, data categories, access, region, and contractual control.
Connector scopes— credentials, revocation, and rotation ownership stated explicitly.
Transport integrity— webhook, file, and API authenticity, replay handling, and failure behavior.
Visible limitations— provider state and constraints stay visible rather than abstracted away.
Subprocessor and provider lists route to the current Privacy sources where approved. Credentials, endpoints, and restricted provider terms are never exposed.
Where a boundary sits
If a connected system is compromised, the blast radius is bounded by the scope you granted it — which is why connector scope, credential ownership, and revocation authority are worth reviewing before you enable one.
A failed integration never broadens access to complete an exchange. Failure states stay visible and owned.
Seven Control Statuses, Applied Honestly
CurrentUnder reviewPartially implementedException activeSupersededWithdrawnEvidence-gated
Identity & access control summary
PublicObjective, scope, mechanism summary, dependencies, and limitations.
- Owner
- Security
- Reviewed
- 01 Jul 2026
- Status
- Current
Limitation: IdP-specific capabilities confirmed per deployment.
Data protection control summary
PublicClassification, minimization, transport and storage protection at public-safe level.
- Owner
- Security
- Reviewed
- 01 Jul 2026
- Status
- Current
Limitation: algorithm and key detail via controlled review only.
Change control evidence
ControlledRelease gates, approval records, and rollback evidence at review depth.
- Owner
- Engineering
- Reviewed
- 15 Jun 2026
- Status
- Current
Access: governed request. Tooling and repositories excluded.
Logging & retention summary
PublicEvent categories, purpose, retention, access, and exclusions.
- Owner
- Security
- Reviewed
- 01 Jul 2026
- Status
- Current
Limitation: detection completeness is not measured to a published standard.
Backup & restoration testing
ControlledRestoration test scope, frequency, and outcome at review depth.
- Owner
- Platform
- Reviewed
- —
- Status
- Under review
Under review: do not rely on this as settled. No RPO/RTO published.
Independent assessment reports
ControlledAssessment summaries where current, with issuer, exact scope, and period.
- Owner
- Security
- Reviewed
- —
- Status
- Evidence-gated
No certification is claimed on this page. Availability is confirmed through review — see the FAQ.
Withdrawn and superseded evidence is not presented as current. Restricted artifact titles are withheld where their existence is itself sensitive, and search terms are never captured in analytics.
Three Columns, No Hidden Transfers
Shared responsibility describes where duties genuinely sit. It is not a mechanism for moving platform obligations onto you.
ZoikoTime
- Platform security and service identities
- Secure delivery and change control
- Environment and tenant separation
- Security monitoring and incident process
- Evidence, correction, and disclosure within approved scope
- Platform defects — these remain ours
Your organization
- Identity provider configuration and user lifecycle
- Role assignment and access review
- Policy configuration and its accuracy
- Endpoints, devices, and networks
- Exports once they leave the platform
- Connected systems you authorize
Providers
- Contracted infrastructure and services
- Within their defined scope only
- Governed by contract, not inherited assurance
- State and limitations visible to you
One thing a customer administrator can never do
Enable prohibited surveillance. The anti-surveillance invariant is not a default, a setting, or a permission — there is no administrative path to screenshots, keystroke content, URL history, application-name monitoring, or clipboard collection.
Request Evidence That Isn't Public
Access level is determined by identity, purpose, and entitlement. Minimal fields, optional free text, secure delivery with expiry.
Request statuses
ReceivedNeeds clarificationUnder reviewApprovedPartially approvedDeclined with reason categoryExpiredWithdrawn
Eight Security Questions
No screenshots, keystroke content, URL history, application-name monitoring, or clipboard collection under any tier or configuration. Security telemetry covers identity, access, change, source-health, service, and incident events — not what a person types, reads, or visits.