Security
What is done to protect your contractor and supplier records, and what is not done yet.
Done
- A company sees only its own records. The database filters them, not the screen.
- Sign in with your company’s work account, or a password.
- Every look at a person’s record is logged, and so is every refusal.
- Nobody approves their own hours, their own job request or a supplier they recommended.
- A person can download or erase their own data. Signed hours and amounts stay.
- When something fails, our staff get an email.
Not done yet
- No SOC 2 report, no ISO 27001 certificate, no penetration test.
- Two-step sign-in comes from your company’s account. Etyme does not enforce it.
- Restoring from backup has not been tested. No disaster recovery plan.
- Encryption is the hosting provider’s. Etyme has not checked it.
- No named security officer.
Next, in this order
- Penetration test
- SOC 2 Type I
- SOC 2 Type II, then ISO 27001
No dates yet, because none is contracted. A date goes here when one is.
Found a problem?
Write to support@etyme.com. Test only on the demo. It holds no real people and no real money.