Skip to main content

Search

Let us guide you!

Administrator security checklist

Your workspaces contain client data. Your automations move it towards third-party tools. Your exports copy it elsewhere. The security of a TimeTonic workspace is played out along the whole chain, from the password of your computer to the webhook that sends a row to an external service. Here are the fourteen points to check, each with the article that explains how to do it.

This checklist is intended for licence owners and workspace administrators, including partners who manage workspaces for their clients. For the complete inventory of the mechanisms available, see the overview.
Contents
  1. 1. What should you check on accounts?
  2. 2. What should you check on data and views?
  3. 3. What should you check on sharing and access?
  4. 4. What should you check around TimeTonic?

1. What should you check on accounts?

1
Enable 2FA or SSO on every account
Not only on yours. A single account without a second factor is enough to open the door. Personal 2FA is available on every plan. Enforcing it on every account, and SSO, require the Business plan.
2
Use long, unique passwords
12 characters minimum, 16 preferably. Never your company name, nor anything derived from your email address. A password manager saves you from having to remember them.

2. What should you check on data and views?

3
Never store credentials in clear text
Passwords for external tools, API keys, access to company accounts: all of it goes into a column of type Encrypted field, encrypted right down to the database. It is also Sensitive from creation: it does not go into exports. Keep its password in your password manager.
4
Mark the fields that hold personal data
Name, email, phone: set these fields to Sensitive with the GDPR / confidential marking option. The Exclude fields marked GDPR / confidential checkbox then removes them from every FTP / SFTP or Metabase export. It is ticked by default, including in an export created by another administrator. Also mark by hand any formula that copies personal data. Marking hides nothing in the application. An encrypted field is already Sensitive: nothing to mark.
5
Do not display what does not need to be read
Do your colleagues need to see the full number, or only to recognise the right row? A formula column with APPLY_MASK() displays only the last four characters, and setting the original column to Invisible does the rest. Remember to tick Hide in record mode as well.
6
Lock what you have configured
A restriction that the user can undo protects nothing. Lock the view settings freezes filters, sorts and restrictions. Depending on the case, also lock the view itself.
7
Check your link columns
A discreet setting, but an essential one. Select a view on each link column: the record then shows only the data of that view. The setting is made link column by link column.
8
Limit each person to their own data
A view filtered on the user ID shows each person only their own rows. For a client or an external contributor, project this view into a dedicated workspace with a mirror view. They then have no access to your production workspace.

3. What should you check on sharing and access?

9
Tick authentication required, in all three places
« Authentication required » exists on the shared form view, on the External form field, and on the Attachments field. Three distinct settings. Protecting the form does not protect the file it contains.
10
Give each API key the minimum rights
Four rights are ticked separately: write, read data, read messages, read the calendar. Your reporting dashboard has no reason to be able to write. Thirty seconds of work that turn a compromised key into a minor incident.
11
Partition the scope as well, with a dedicated API account
The rights of a key define what it can do, not what it can see. A read-only key created from your administrator account reads everything you can see. Create a dedicated account per integration, limited to the filtered views required.
12
Name your keys, and do the housekeeping
Name them after their use (api-make, api-n8n, api-reporting-client): it is the only way to delete the right one, months later, without cutting off an integration in production. A forgotten key is a key that will end up serving somebody else.
13
Audit your outgoing flows
Metabase, Zapier, Make, n8n, webhooks, FTP, AI automations: for each flow, ask yourself « which columns actually leave? ». Create dedicated export views rather than sharing a whole table. In every FTP / SFTP or Metabase export, check the Exclude fields marked GDPR / confidential checkbox. An export created before marking was released has no checkbox ticked. The manual CSV export does not remove marked fields.

4. What should you check around TimeTonic?

14
Beware of screen recordings, and of your own computer
A demonstration filmed on real data is a leak waiting to happen: use a test data set, protect the recording, delete it once it has been used. And do not forget the simplest link in the chain: an up-to-date antivirus, and automatic session locking as soon as you step away. The best TimeTonic configuration does not protect a screen left open.
If you suspect a data breach. Contact TimeTonic's data protection officer immediately: dpo@timetonic.com. In the event of a confirmed breach, the data controller has 72 hours to notify the supervisory authority. What to do: Your GDPR obligations in TimeTonic.

Go further

Security overview

The complete inventory, from the account to the API.

Read more →

Go further

Check your external sharing

The detail of the three control points of point 9.

Read more →

Go further

Create a restricted API account

The complete implementation of points 10 and 11.

Read more →
Aidez-nous à améliorer notre contenu : cet article vous a-t-il été utile ?
Utilisateurs qui ont trouvé cela utile : 3 sur 4
Return to top