Security
Your team's hours, pay and documents, kept safe.
CrewClock holds salaries, bank details and ID copies, so we treat it like the payroll system it is. This page says plainly where the data lives, how it is protected and what you can ask us for.
Hosted in the EU
The application, database and uploaded files run on Hetzner Online GmbH servers in Helsinki, Finland. The only copy held elsewhere is a disaster-recovery backup at our office, covered by the standard contractual clauses in our Data Processing Agreement.
Encrypted in transit
Every connection uses HTTPS with HSTS; plain HTTP is never served. Email and push notifications go through providers that encrypt in transit as well.
Daily backups
The database and uploaded files are backed up every day, kept for 14 days on the server and up to 30 days off-site. We restore from backup if data is lost through a fault on our side.
Two-factor sign-in
Any account can turn on two-factor sign-in with an authenticator app. Passwords are stored as one-way hashes; sign-in attempts are rate-limited.
Workspace isolation
Every query is scoped to the signed-in organisation. Nobody can see, search or export another company's data, and our own support access is recorded.
Roles and permissions
Owner, approver and team member are built in; custom roles get exactly the permissions you choose. Sensitive fields such as salary, bank details and documents are limited to roles with that permission.
Activity log
Every change is logged with who, when, before and after. Most changes can be reverted with one click from the log.
Your data, exportable
Every report, invoice and salary slip exports to Excel, CSV or PDF. A full workspace export is available on request, and the owner can ask for permanent deletion at any time.
Compliance and paperwork
- GDPR. We act as processor for the data in your workspace and as controller for account, billing and website data. The Privacy Policy lists the legal bases, your rights, the retention periods and every sub-processor with its location.
- Data processing agreement. Our standard Article 28 agreement is published as the Data processing agreement; it applies to every workspace, and a countersigned PDF is available on request.
- Breach notification. If a breach affects your data we notify you without undue delay and within 72 hours of becoming aware, with what happened and what we are doing about it.
- Export and deletion. Every report, invoice and slip exports to Excel, CSV or PDF from inside the app. A full workspace export is available on request; the owner can ask for permanent deletion, and backups expire within 30 days after that.
- Who runs it. CrewClock is built and operated by Dynamics Bridge, which runs its own timesheets, leave, payroll and invoicing on the same system. There are no third-party trackers or analytics on the site or in the app.
Responsible disclosure
If you believe you have found a security issue, please email contact@dynamicsbridge.com with the steps to reproduce it. We acknowledge reports within two working days, keep you informed while we fix the issue, and do not take legal action against good-faith research that avoids customer data and service disruption. Please do not test against customer workspaces; the public demo is the right place.
See how it works before you trust it with payroll.
The demo is a sample company with every page unlocked; the trial is your own workspace, ready in a minute.