Security Overview

Version 1.0 · Effective 7 October 2026

A short, factual description of how IzyShift protects your data. The binding commitments are in Annex 2 of the Data Processing Agreement.

Hosting

The application and database run on servers operated by Hetzner Online GmbH in the EU (Germany and Finland). Hetzner's data centres are ISO/IEC 27001 certified.
Off-site backup copies are encrypted before they leave the server (see Backups).

All traffic to izishift.cc, app.izishift.cc and punch.izishift.cc uses HTTPS (TLS). Plain HTTP is redirected.
The login cookie is Secure, HttpOnly and SameSite=Lax.
The Android app only connects over HTTPS (cleartext traffic is disabled).
Credentials for POS integrations are stored encrypted.
Employees' bank details (IBAN) for salary payouts are encrypted at rest, shown masked in lists, and the full IBAN is shown only on an explicit request by an owner or administrator; every view and change is logged.

Passwords are stored only as salted PBKDF2 hashes. We cannot see your password.
Login attempts are rate-limited per account and per IP address.
Telegram logins are checked by Telegram's cryptographic signature.
Permissions are enforced on the server for each action, not just hidden in the interface. There are five access levels: employee, manager, department manager, administrator and owner. Only owners and administrators see pay data.
Each customer's data is separated by company in every database query. Cross-company access attempts are covered by automated tests.
The punch-terminal link is a long random token that the owner can revoke at any time. Wrong PINs lock the terminal temporarily.

Location is taken only at the moment of clocking in or out, and only if the employer enables location checks.
Photos are resized and their location metadata (EXIF) is removed.
Voice notes are transcribed, and the audio is not kept.
No advertising or analytics trackers.

Daily backups, encrypted with AES-256 (GPG), kept on rotation locally and off-site. Restores are tested automatically every week.
Service monitoring checks the application every 10 minutes and alerts us about failures.

Server administration is limited to authorised administrators. Root login accepts SSH keys only.
Secrets are kept outside the code repository with restricted permissions.
Changes are version-controlled and tested before deployment. A database backup is taken before every schema change.
Tests run on isolated copies of data and never send messages to real people.

If we become aware of a personal data breach affecting your workspace, we notify you without undue delay and within 48 hours, as set out in the DPA.

Please write to info@izishift.cc. Do not test against other customers' data.

We describe what we do today and do not claim certifications we do not hold. IzyShift itself is not ISO 27001 or SOC 2 certified.