Trust
Security
How TimeWave protects your credentials, access and organization data.
Authentication
Passwords are hashed with bcrypt and sessions live in a signed, httpOnly cookie. Turn on two-factor auth (TOTP) with one-time backup codes for an extra layer.
Roles & access control
Owner, admin, manager and member roles gate every action. Every org-scoped request is re-authorized server-side, so people only ever see their own organization's data.
Scoped API keys
API and MCP keys carry read / tasks / timer scopes, act only as the user who made them, never grant more than that user has, and can be revoked at any time.
Encrypted secrets
Repository access tokens are encrypted at rest (AES-256-GCM) and never shown again after they're saved.
Audit log
Sensitive actions — invites, role and rate changes, key creation, settings and plan changes — are recorded in an organization audit log, with AI-driven actions clearly badged.
Your data stays yours
One tenant's data is never mixed with another's. Clients you invite get read-only access to a single project, exactly as much as you allow, and you can export everything at any time.
Found a security issue? Get in touch — see the FAQ.