Skip to main content

Search

Let us guide you!

Overview: everything TimeTonic gives you to protect your data

Data protection in TimeTonic relies on around forty mechanisms, spread across seven levels. They range from the user account down to the API call. This page brings them all together, with what each one protects and where it is documented. It is the entry point of this category. One setting protects from the start: the encrypted field encrypts the data and stays out of exports, with nothing to configure.

How to read this page. The levels go from the broadest to the finest. A setting applied at a high level, for example a member's role, applies to everything below it. A fine-grained setting, for example a column made invisible, only protects within the view where it is applied. A sound configuration combines several levels.
Contents
  1. 1. How do you protect the account?
  2. 2. How do you protect the workspace?
  3. 3. How do you protect a view?
  4. 4. How do you protect a column?
  5. 5. How do you protect the record and link columns?
  6. 6. How do you protect sharing and exports?
  7. 7. How do you protect API access and integrations?
  8. 8. Which documents cover compliance and your obligations?

1. How do you protect the account?

Mechanism What it protects
Securing your organisation's accounts The starting point: the account settings to check, one by one.
Turn on 2FA on your account Sign-in, even if the password leaks. Every plan.
Enforce 2FA and SSO for your users 2FA or SSO required for every user. Business plan.
Password, sessions, email: secure your access The password, also required to create an API key. Logging out your other sessions: browser, mobile and API keys in one go.
Manage your users' rights in one place What each user can do at account level, from the overview in the admin area.
Invitation link: require a confirmation Each arrival through an invitation link waits for your approval.
Block or delete a user account Cuts off access for a user who leaves your organization.
License types: limit each user's access Limits each user's access, beyond their workspace role. Business plan.

2. How do you protect the workspace?

The essentials of this level, on one page → Protect the workspace

Mechanism What it protects
Member rights The role (Owner, Admin, User), web and mobile access, API access, messages and the member list, person by person.
Invitations Who has been invited, and who has not accepted yet. A pending invitation is still an open access.
Mirror view to a dedicated workspace Gives a client or a contributor a workspace that contains only what concerns them, with no access to your production workspace. Prepare the view before sharing it → Create and use a mirror view, chapter 4
User ID as a default value Limits each person to their own rows, through a view filtered on their identifier.
Workspace ID as default value Limits a view to the rows of one workspace, through a filter on its ID.
Filter a view by user ID for a mirror workspace Step by step: each technician or client reaches their own data, without the main database.

3. How do you protect a view?

The essentials of this level, on one page → Protect a view

These settings only apply to the view where you set them. They decide what the person who opens it sees. You find them in the ⋮ menu, under Actions on the view, and under the Hide fields button → View options

Mechanism What it protects
Field restrictions Each field set to Read / Write, Read-only or Invisible. The central mechanism, to set before any sharing or export.
Mandatory search The view opens empty: the user only sees the rows they search for.
Lock the view settings Freezes filters, sorts and restrictions, so that a user cannot undo them.
Lock the view Prevents the view itself from being modified.

4. How do you protect a column?

The essentials of this level, on one page → Protect a column

Mechanism What it protects
Encrypted field Encrypts the data, including on the server side. The only mechanism that protects the data itself. Sensitive from creation: excluded from exports automatically.
GDPR / confidential marking Flags personal data to exclude it from FTP / SFTP and Metabase exports. Hides nothing in the application. The encrypted field is marked automatically.
APPLY_MASK() Displays only part of the value. To be combined with a restriction, otherwise it protects nothing.
Conditional visibility Displays the field only if a condition is met.

5. How do you protect the record and link columns?

The essentials of this level, on one page → Protect the record and link columns

A setting worth knowing. A link column displays records from another table. Select a view on this column: it sets which rows and fields of the linked table are visible from the record. Check link columns just as you check the columns of the view.
Mechanism What it protects
Link column: choose the view Determines which rows and which columns of the linked table are visible from the record.
Selection filters on the link column Limits what the column offers for selection.
Mirror view: link columns with no selection In a mirror workspace, a link column with no selected view shows no data.
Change history The column shows the old and new value of every change, with the author, even for columns invisible in the view. Remove it from any shared view.

6. How do you protect sharing and exports?

The essentials of this level, on one page → Protect sharing and exports

Mechanism What it protects
Authentication required, in all three places Shared form view, External form field, Attachments field. Three independent settings.
Single-use token Makes a form link unusable after the first submission.
Invisible CAPTCHA and sharing options Blocks automated submissions on a deliberately public form.
Attachments A file has its own address: it is protected separately from the form that displays it.
Share your table data The overview of sharing, including how to delete the share URL.
Exported fields (FTP / SFTP, Metabase) Two checkboxes, ticked by default. Exclude fields marked GDPR / confidential removes sensitive fields. Exclude non-exportable field types by default removes eight field types, including E-mail, Phone and Attachments.

7. How do you protect API access and integrations?

Mechanism What it protects
API keys and their four rights Write, read data, read messages, read the calendar: tick the minimum.
API account restricted to filtered views Limits what the key can see, which its rights do not do.
filterRowIds Returns only the rows of a filtered view, on the development side.
Revoke an access Sessions, API keys, share links, invitations: four distinct mechanisms.
Your AI keys (BYOK) What TimeTonic does, and does not do, with your OpenAI or Mistral keys.

8. Which documents cover compliance and your obligations?

Document What it is for
Your GDPR obligations in TimeTonic The register, data subject requests, and who to contact.
GDPR in TimeTonic TimeTonic's commitment.
Privacy policy The reference document.
GDPR register template A ready-to-use workspace for keeping your register.

Where to start

Administrator checklist

The fourteen points to check on your workspaces right away.

Read more →

To choose

Encrypt, mask or restrict

The decision guide between the mechanisms.

Read more →

To answer quickly

Frequently asked questions

Short answers, grouped by topic.

Read more →
Aidez-nous à améliorer notre contenu : cet article vous a-t-il été utile ?
Utilisateurs qui ont trouvé cela utile : 3 sur 4
Return to top