Security & Trust
Your billing data, isolated and yours
Timix holds your clients, rates, and margins, so isolation, access control, and a clean audit trail are built in — not bolted on. Here's exactly how your data is protected, and how you stay in control of it.
01 Isolation & access
Every organization fully isolated
Timix is multi-tenant by design: each organization's data is walled off, and access is enforced on every request across both the app and the API.
- Per-organization data isolation, enforced on every request — app and API alike.
- Role-based access with 6 roles (Owner, Admin, Finance, Manager, Member, Viewer) — cost rates, profit, and margin are restricted by role, so Members and Viewers never see the money side.
- One login can hold several organizations, and they never see each other’s data.
02 Accountability
A trail you can defend to a client or auditor
Every billable number is traceable back to who logged it, who approved it, and the rate in effect at the time.
- Approval workflow with history: Draft → Submitted → Approved, with reject reasons recorded.
- Effective-dated cost-rate history, so past margins stay correct when pay changes.
- Soft-delete to a 30-day recycle bin — accidental deletions are reversible, nothing vanishes on a click.
03 Your data, portable
Export anytime — no lock-in
Your data is yours to take with you, during a trial or after.
- Export your time, billing, and reports to CSV or PDF whenever you want — no export fee.
- If you cancel, your data is kept for 90 days (export anytime in that window), then permanently deleted.
- No lock-in: you can leave with your data intact.
04 Infrastructure & privacy
Built on Google Cloud, GDPR-friendly
Solid foundations, with privacy by default.
- Hosted on Google Cloud, with your data encrypted in transit and at rest.
- GDPR-friendly, with a Data Processing Agreement (DPA) available on request.
- We never use your data to train AI. The Timix.AI assistant in the app runs on Google Cloud Vertex AI and only answers your own questions, inside your workspace.
- Passwordless passkey / biometric sign-in; SAML SSO and SCIM provisioning on Enterprise.
05 Connected AI assistants
Connect Claude or ChatGPT, and keep control
An AI assistant you connect to Timix.AI works within the same roles and isolation as the app.
- It acts as the person who connected it, and sees and changes only what that person's role allows, checked on every request.
- Costs, margins, pay rates and people's contact details stay hidden from it unless an Owner, Admin, Finance or Manager user allows them.
- Deleting, closing a period and invoicing need a second, explicit request from the assistant.
- Every action it runs is recorded: which action, by whom, with which key and from which IP address. What it sent and got back is not kept.
- Every connection is a key on the API Keys page, and revoking it stops the assistant at once.
06 Reporting a vulnerability
Found a security issue? Tell us
We want to hear about it. A person reads every report.
- Email hello@timix.ai with what you found and the steps to reproduce it.
- Test only with your own account and organization, and do not access, change or delete anyone else's data.
- Give us a reasonable time to fix the issue before you make it public.
- Our security contact is also published in /.well-known/security.txt.
Ready when you are
Start billing every hour you earn.
90-day free trial on every new workspace — full access to everything, no credit card.