Security at Clockie

Every workspace has a unique companyId. Every record in our database carries it. Every query is filtered by it at the database level — not in your browser. Our security rules enforce the filter independently of the app code, so even a buggy client cannot read another company's data.

Rules are split per access pattern (single-doc reads vs. list queries) so the database can refuse cross-tenant access before any data leaves the server.

• Passwords are never stored — Firebase Authentication handles credential storage with bcrypt-equivalent hashing.
• Sessions are HttpOnly + Secure cookies — JavaScript on the page cannot read them, so XSS cannot exfiltrate the credential.
• Master admin accounts require verified email on both the database and server layers.
• Deactivating an employee revokes their refresh token immediately, forcing every device to bounce to sign-in.

• All data in transit uses TLS 1.2+. We use Google's managed certificates with automatic rotation.
• All data at rest is encrypted with Google Cloud's default storage encryption (AES-256).
• File uploads (selfies, documents, chat attachments) are encrypted server-side by Cloud Storage.

Four roles enforced at the database layer:

• Employee — own profile, own attendance, chat, leave applications.
• Manager — approve leaves for direct reports.
• HR Admin — employee management, payroll, all leave approvals, documents.
• Super Admin — full workspace administration, audit log access.

A user cannot escalate their own role — even if they edit their profile, the rule layer rejects any role change on a self-write.

Every significant administrative action — leave approvals, employee creation, password resets, document deletions, role changes — is written to an append-only audit log. Entries cannot be edited or deleted, even by super admins. The log includes who did what, when, and on whom.

Admins and HR can view their own workspace's log at/admin/audit. We retain audit history for the full life of the customer's account.

• Strict MIME allowlist — no HTML, no SVG (cannot host inline scripts), no executables.
• Magic-byte content sniffing — files are inspected by their first few bytes, not just their declared type, to catch payloads with spoofed headers.
• Per-path size caps enforced both client- and server-side.
• Tenant-scoped paths — a user cannot write to another company's folder even if they bypass the UI.
• Avatar and biometric photo reads check the owner's workspace; cross-tenant fetches are denied.

• Code review for every change touching authentication, rules, or upload paths.
• Pre-launch comprehensive security audit covering OWASP categories, multi-tenant isolation, privilege escalation, and broken object-level authorization.
• Continuous monitoring of Firebase usage, Cloud Run errors, and authentication anomalies.
• Customer billing alerts catch runaway costs before they impact uptime.
• Master admin allowlist is short, hard-coded, and email-verified — there is no "become admin" back door.

Clockie runs on Google Cloud Platform. Our primary database (Firestore) and file storage are hosted in [REGION]; our application runs on Cloud Run in us-central1. Customer data is never transferred to third parties except the strictly-required sub-processors listed in ourPrivacy Policy.

We're building toward:

• SOC 2 Type 1 — controls implementation in progress.
• India DPDPA 2023 — privacy officer appointed, grievance mechanism in place.
• GDPR — data processor responsibilities followed; DPA available on request.
• ISO 27001 — under evaluation for late 2026.

For procurement / security questionnaire support, emailsecurity@shipcube.com.

We welcome security research. Our public disclosure policy is at/.well-known/security.txt. We aim to acknowledge reports within 48 hours and provide a patch ETA within 10 business days.

Thanks to the security researchers who have responsibly disclosed issues to us. With permission, we publish names and discoveries here. (No public reports yet.)