Security

• HTTPS everywhere

  The app, the API, media and this website are served over HTTPS only.

• Private selfies

  Attendance photos are never on public links. They are opened through signed links that expire after about fifteen minutes, and uploads go straight to private storage.

• Organizations kept apart

  Every request is checked against the signed-in user’s membership. One organization cannot read another’s data, whatever the app sends.

• Role-based access

  Owners and admins see the whole organization; managers see only the branches they are given; employees see only their own attendance.

• Audit trail

  Corrections, manager-entered attendance, approvals, voids and exports are logged with who did them and why. Voiding never deletes the original record.

• Server time

  Attendance is timed by our server, not the phone clock, and retried submissions cannot create duplicates.

• Review, not blind trust

  Check-ins from outside the area, a new installation, or an impossible journey between branches are flagged for review.

• Passwords

  Stored only as bcrypt hashes. Attendance submissions are rate-limited.

• Signed app updates

  Over-the-air app updates are cryptographically signed and verified by the app before installing.

Report a security issue

If you find a vulnerability, email [email protected] with the details. Please give us a chance to fix it before telling others.

Preez does not currently hold security certifications such as SOC 2 or ISO 27001.