Skip to main content

Search

Let us guide you!

Administrator security checklist

Your workspaces contain client data. Your automations move it towards third-party tools. Your exports copy it elsewhere. The security of a TimeTonic workspace is played out along the whole chain, from the password of your computer to the webhook that sends a row to an external service. Here are the twelve points to check, each with the article that explains how to do it.

This checklist is intended for licence owners and workspace administrators, including partners who manage workspaces for their clients. For the complete inventory of the mechanisms available, see the overview.

Accounts

1
Enable 2FA or SSO on every account
Not only on yours. A single account without a second factor is enough to open the door. Available from the Business plan onwards.
2
Use long, unique passwords
12 characters minimum, 16 preferably. Never your company name, nor anything derived from your email address. A password manager saves you from having to remember them.

Data and views

3
Never store credentials in clear text
Passwords for external tools, API keys, access to company accounts: all of it goes into a column of type Encrypted field, encrypted right down to the database. Keep its password in your password manager.
4
Do not display what does not need to be read
Do your colleagues need to see the full number, or only to recognise the right row? A formula column with APPLY_MASK() displays only the last four characters, and setting the original column to Invisible does the rest. Remember to tick Hide in record mode as well.
5
Lock what you have configured
A restriction that the user can undo protects nothing. Lock the view settings freezes filters, sorts and restrictions. Depending on the case, also lock the view, the table, and the creation or deletion of records.
6
Check your link columns
This is the least visible leak. A link column with no view selected gives access, from the record, to the data you had hidden in the view. The setting is made link column by link column.

Sharing and access

7
Tick authentication required, in all three places
« Authentication required » exists on the shared form view, on the External form field, and on the Attachments field. Three distinct settings. Protecting the form does not protect the file it contains.
8
Give each API key the minimum rights
Four rights are ticked separately: write, read data, read messages, read the calendar. Your reporting dashboard has no reason to be able to write. Thirty seconds of work that turn a compromised key into a minor incident.
9
Partition the scope as well, with a dedicated API account
The rights of a key define what it can do, not what it can see. A read-only key created from your administrator account reads everything you can see. Create a dedicated account per integration, limited to the filtered views required.
10
Name your keys, and do the housekeeping
Name them after their use (api-make, api-n8n, api-reporting-client): it is the only way to delete the right one, months later, without cutting off an integration in production. A forgotten key is a key that will end up serving somebody else.
11
Audit your outgoing flows
Metabase, Zapier, Make, n8n, webhooks, FTP, AI automations: for each flow, ask yourself « which columns actually leave? ». Create dedicated export views rather than sharing a whole table.

Around TimeTonic

12
Beware of screen recordings, and of your own computer
A demonstration filmed on real data is a leak waiting to happen: use a test data set, protect the recording, delete it once it has been used. And do not forget the simplest link in the chain: an up-to-date antivirus, and automatic session locking as soon as you step away. The best TimeTonic configuration does not protect a screen left open.
If you suspect a data breach. Contact TimeTonic's data protection officer immediately: dpo@timetonic.com. In the event of a confirmed breach, the data controller has 72 hours to notify the supervisory authority. What to do: Your GDPR obligations in TimeTonic.

Go further

Security overview

The complete inventory, from the account to the API.

Read more →

Go further

Check your external sharing

The detail of the three control points of point 7.

Read more →

Go further

Create a restricted API account

The complete implementation of points 8 and 9.

Read more →
Aidez-nous à améliorer notre contenu : cet article vous a-t-il été utile ?
Utilisateurs qui ont trouvé cela utile : 3 sur 4
Return to top