Security

Signing in

• Passwords are stored only as a hash computed with argon2. The password itself is not stored and cannot be recovered from the database.
• Two-factor authentication: one-time codes from an authenticator app, set up with a QR code.
• Sign-in attempts are limited: no more than a few per 15 minutes from one address, after which sign-in is temporarily blocked. A general rate limit applies to all API requests.

Sessions and connection

• The connection to the service is encrypted (HTTPS), and the server sends security HTTP headers.
• Session keys are stored in cookies that page scripts cannot access and are sent only over a secure connection. The page code never sees them.
• The access key lives for minutes. The session refresh key is replaced with a new one each time it is used, and the old one stops working.
• The account settings list active sessions with devices — any of them can be ended, or all except the current one at once.

Access within an organization

• Permissions are defined by role: owner, administrator, accountant, manager, employee. Checks run on the server, not just in the interface.
• Financial data — rates, revenue, cost, profit — is not sent by the server to managers and employees at all, rather than merely hidden on screen.
• Colleagues see private time entries without the task and project name.
• Approved timesheets cannot be edited: confirmed hours do not change retroactively.
• Changes in the organization are recorded in the activity log: who changed what and when.

Reporting a vulnerability

If you find a vulnerability, contact us via email at support@eratrack.net or Telegram at t.me/eratrack. Please do not publish details until the issue is fixed, and do not use the vulnerability to access other people’s data.

Contacts

For any questions about the Service:

• email: support@eratrack.net;
• Telegram: t.me/eratrack.