Orca Time Information Security

1. Security by Architecture

Orca Time stores sensitive workplace data, so the design starts from the assumption that access rules must be enforced where the data lives, in Postgres, rather than in application code that could be bypassed.

• Owner-only raw tables. Row-level security on every raw tracking table restricts each row to the person it belongs to. No user, admin, or operator role can select another person's raw rows directly.
• A security-definer read API as the sole cross-user path. Team views and reports are served exclusively through database functions that check organisation membership, role, and the organisation's detail setting (granular or holistic) on every call. There is no other route from one user's session to another user's data.
• Structural redaction of the platform operator. The operator (super admin) view is built on aggregates. Organisation names and aggregate activity totals are present in the operator-accessible result set, to support the service and the coaching relationship. Individual personal names, window titles, URLs, domains, and content are not present in any operator-accessible result set. This individual-level redaction is a property of the read path, not an access policy.
• Per-organisation isolation. Every query path is scoped to the caller's organisation; cross-organisation reads have no supported route.

2. Adversarial Testing

The isolation model is tested adversarially, with test suites that attempt the attacks directly against the live schema: reading another user's rows, reading another organisation's data, exceeding the seat cap, and extracting redacted fields through the operator view. The full suite passed on 20 August 2026, and is rerun when the schema changes.

3. The Mac App

• Developer ID signed and notarised by Apple, so macOS verifies the binary before it runs.
• Distributed from time-mac.simmance.ai and updated automatically via Sparkle, so installed copies stay current with security fixes.
• Structurally incapable of capturing keystrokes, screenshots, or content: the capture surface is the frontmost app, window title, active tab URL, and idle state, and nothing else.

4. Hosting

All operational data is hosted in a Supabase project in the EU, on AWS eu-central-1 (Frankfurt). Data is encrypted in transit (TLS) and at rest by the hosting platform. The web dashboard is a static application served by Netlify; operational data flows between the browser and Supabase directly.

5. Licensing as a Kill-Switch

Licences are provisioned by the publisher and validated via Keygen. Suspending a licence stops all sync immediately, for every seat in the organisation, which gives both the publisher and the customer a clean, product-wide off switch independent of individual devices. Keygen holds only the organisation's company name and admin email in licence metadata.

6. Reporting a Concern

If you believe you have found a security issue in Orca Time, email chris@simmance.ai. Related documents: data processing agreement, privacy notice, licence agreement.