2FA adds a one-time code on top of your password. It is available on every plan. SSO, and enforcing 2FA for every user, require the Business plan. Enable it on every account, without exception: a single account without a second factor is enough to open the door.

Learn more → Two-factor authentication (2FA)

At least 12 characters, ideally 16, with uppercase and lowercase letters, digits and special characters. Avoid anything that can be guessed: your name, your email address, your company name. Change it immediately if you have any doubt, and regularly outside of any incident. A password manager saves you from having to remember them.

Learn more → Securing your organisation's accounts

From your profile, use the Log out your other sessions option. It destroys all your current sessions: web, mobile and API. Careful: your API keys stop working and will have to be regenerated.

Learn more → Edit my profile and my options

An access that is no longer used remains an exploitable access if your account is compromised: remove yourself from the workspace, or ask to be removed.

Watch out for the right place. From Account → Received invitations, the Cancel button does take you out of the workspace, but the action is reversible: the row goes back to « Not accepted » and one click on Accept gives you access again. So it is not a revocation.

To leave for good, open the workspace and click the Members icon at the top right. If you are an Admin there, a trash icon appears on your own row and lets you remove yourself, permanently. If you are a User there, only the owner or the administrator who invited you can do it.

Learn more → Manage your invitations · Set member rights

Create a column of type Encrypted field. It encrypts the information right down to the database, behind a password specific to the field. It is also Sensitive from creation: it does not go into exports. Never store credentials in clear text in a text field.

Learn more → Encrypted field

In three different places, which do not replace one another. This is the most common trap: protecting the form does not protect the attachment it contains.

1. On a shared form view: Share button, then Edit options.
2. On a field of type External form: Options tab of the field.
3. On an Attachments field: Options tab of the field.

Check all three, every time.

Learn more → Check your external sharing

On a field of type External form, tick Single-use token in the options. The link stops working after the first submission. This is the protection to favour when you send a form by email: a link that is forwarded, or found in a mailbox months later, no longer opens anything.

Learn more → External form

Open the Share window of the view concerned and click Delete the share URL of the view. The link stops working immediately, for everyone.

Learn more → Revoke an access

Restrictions are set view by view, in the Field restrictions window. Each field there takes one of three levels: Read / Write, Read only or Invisible. Remember to tick Hide in record mode as well, otherwise the field reappears when the record is opened.

Another mechanism depends on the state of the row rather than on the reader: conditional visibility.

Learn more → Choosing the right level of protection · Restrict access to a column view by view

No. GDPR / confidential marking only controls exports. Every member who saw the field still sees it, filters it and edits it. Only the workspace owner and administrators can change the marking. To hide data from some members, use an encrypted field or the view permissions.

Learn more → GDPR / confidential marking: mark a field

Two very common causes.

Link columns. A link column displays the records of another table through a view of that table. If no view is selected on it, from the record the user reaches data that you had hidden. The setting is made link column by link column.

The configuration has not been locked. Without Lock the view settings, a user can remove a filter or display a column again.

Learn more → View selection on a link column · Lock the options of a view

Create a formula column with APPLY_MASK(). The mask uses @ to display a character and X to hide it.

Displays only the last four characters.

Combine it with setting the original column to Invisible: without that, the mask protects nothing.

Learn more → APPLY_MASK()

Combine a view filtered on the user identifier with a restricted role. To go further, project that view into a dedicated mirror workspace: the person then works in a workspace that contains only what concerns them.

Learn more → Use the user ID as a default value · Create and use a mirror view · Filter a view by user ID for a mirror workspace

From the Settings of your account, section API keys (SessKey), click Add a new API key. Give the key a name, tick the rights, enter your account password, then confirm.

Learn more → Create and manage your API keys (Sesskey)

Four rights are ticked independently at creation: write in TimeTonic, read data, read messages, read calendar events. Grant only what the integration needs. A reporting integration has no reason to be able to write.

Yes. The rights of the key define what it can do, not what it can see. A key inherits the scope of the account that created it.

To restrict the scope, create a dedicated account, give it access only to the filtered views required, then generate the key from that account.

Learn more → Create an API account restricted to filtered views

In the list of API keys (SessKey), click the trash icon next to the key concerned. The key stops working immediately, without affecting the others.

Always name your keys after their use (api-make, api-n8n, api-reporting-client): that is what will allow you to delete the right one, months later.

Learn more → Revoke an access

Review all the views you share with third-party tools (Metabase, Zapier, Make, n8n, external webhooks, FTP, AI automations) and limit each flow to the columns that are strictly necessary. A dedicated export view is better than sharing the whole table. Mark the personal fields. In FTP / SFTP and Metabase exports, keep the Exclude fields marked GDPR / confidential checkbox ticked. The manual CSV export does not remove them: exclude them field by field when you download.

Learn more → Personal data and technical data · Share your table data · Exclude fields from an export: sensitive data and GDPR

The detailed answer is covered in a dedicated article.

Learn more → Does TimeTonic store my OpenAI or Mistral API key?

Beyond names and email addresses, technical data (IP addresses, share URLs) and activity traces are concerned: the Changes panel of a record displays the old and the new value of each field, the author and the timestamp. Not forgetting free text content, where nobody thinks to look: SmartText, comments, descriptions, notes.

Learn more → Personal data and technical data · GDPR / confidential marking: mark a field

Mark the field Sensitive with the GDPR / confidential marking option. Keep the Exclude fields marked GDPR / confidential checkbox ticked in your FTP / SFTP and Metabase exports. It is ticked by default. Marked fields stay out of the file, even when marked later. A formula that copies personal data must be marked by hand.

Learn more → GDPR / confidential marking: mark a field · Exclude fields from an export: sensitive data and GDPR

The principle is to collect and expose only what is strictly necessary, right from the design stage. In practice: an export view contains only the useful columns, an external form asks only for the essential fields, an AI automation receives only the field to be processed.

Avoid it. If it is essential in order to report a bug, use a test data set, enable authentication protection on the recording, and delete the video as soon as it has served its purpose.

Record the request in your GDPR register, with the date, the requester, the nature of the data and the action taken.

Learn more → Your GDPR obligations in TimeTonic · GDPR register template

Contact TimeTonic's data protection officer (DPO) immediately: dpo@timetonic.com. In the event of a confirmed breach, the data controller has 72 hours to notify the supervisory authority. In France, this is done through the notification service on cnil.fr.

Learn more → Revoke an access · GDPR