Security
Less to protect, by design.
HourBack keeps as little as it can, removes personal details on each computer before anything is saved, and encrypts the rest before it leaves the computer. This page explains how, for the people who have to sign off on it.
- No screenshots, keystrokes or clipboard
- Encrypted on the computer
- A separate key for every pilot
- No inbound ports or admin rights
How data moves
Raw activity is only ever held encrypted. The service that receives it can't read it.
- 1
On the computer
Activity is recorded from work apps only. Names, contact details, IDs and card and account numbers are removed before anything is written to disk.
- 2
Before upload
Each hourly batch is encrypted with the pilot's public key. The computer can encrypt but can't decrypt, not even its own earlier uploads.
- 3
Stored
Encrypted batches are stored as they arrive. The service that receives them can't unlock the pilot's key.
- 4
Analysis
A separate, isolated analysis job is the only component allowed to unlock the pilot's key, using a key management service that records every use.
- 5
Reports
Reports are delivered through private, expiring links, and personal reports go only to the person they describe.
On each computer
- Never collected: screenshots, screen or audio recordings, keystrokes, passwords or anything typed into password fields, and clipboard contents.
- Redaction before saving. Names, email addresses, phone numbers, usernames, employee IDs, dates of birth, government ID numbers, and card and bank account numbers are removed on the computer before the activity record is written.
- Exclusions. Chat and messaging, personal email, banking and other personal apps and sites are never recorded. You can add your own apps and sites to the list.
- Values moved between apps are compared using one-way codes held in memory for a few minutes and never saved.
- A one-hour hold. Activity waits on the computer for an hour before upload, so a person can pause, switch to private mode or delete the last hour, and it never leaves their machine.
Encryption and keys
- Encrypted on the computer to the pilot's public key: X25519 key agreement, HKDF-SHA256 and AES-256-GCM, with a fresh key for every batch.
- TLS in transit for every connection: uploads, sign-in, questionnaires and report links.
- A separate key pair for every pilot. One customer's key can never open another customer's data.
- Private keys never stored in the clear. Each one is wrapped by a cloud key management service as soon as it's made, and bound to its pilot so it can't be moved to another.
- Separation of duties. The service that creates keys and receives uploads can only lock keys, never unlock them. Unlocking needs a separate permission held by the analysis job.
- Questionnaire answers are encrypted the moment they arrive and stored under a random code instead of the person's name.
Access and accountability
- Least privilege. Each part of HourBack runs under its own identity with only the permissions it needs.
- Staff access to HourBack's administration goes through single sign-on behind a zero-trust access gateway, limited to named people.
- Audit trail. Pilot changes, sign-ins, report publishing and deletions are logged with who did them and when.
- Secrets live in managed secret stores, never in source code.
- Device credentials. Each computer gets its own upload credential, kept in Windows Credential Manager. We store only a one-way hash of it, and one person's access can be revoked without affecting anyone else in the pilot.
- Partner access you control. A consultancy works in your account only at the level your admins choose (setup, reports by role, or everything including by name), checked on every request. You can change or remove it at any time, and every view and change its people make is listed for your admins. Partners never see personal reports.
- Passwordless sign-in for customers, through one-time email links that expire, so there are no HourBack passwords to steal or reuse.
Controls you set for each pilot
- Reports by name, or by role only with a minimum group size of five.
- How much of an email is recorded: redacted text, only its length and number of questions, or nothing.
- Whether ticket, case, policy and claim numbers are kept or removed on the computer.
- Which email domains can join, and your own excluded apps and sites.
- App status for each person (running, paused or not checking in), with optional alerts. You never see what anyone was working on.
- End the pilot whenever you choose. Data is deleted on the schedule in our Privacy Policy, or sooner on request.
AI processing
- HourBack uses Claude through Anthropic's commercial API. Only redacted, minimal excerpts are sent.
- Anthropic doesn't train its models on API data and deletes it within 30 days by default.
- We never use customer data to train models, and never combine one customer's data with another's.
- HourBack makes no automated decisions about individuals. Reports inform decisions that your people make.
Hosting and deployment
- Runs on Cloudflare and Google Cloud, with analysis in the United States. Every provider and what it does is listed in our Privacy Policy.
- The Windows app installs per user, with no admin rights and no inbound ports. It only makes outbound HTTPS connections to HourBack.
- Deploy silently with Intune or another tool, joining people with their Windows work sign-in, and remove it the same way. Removing it deletes the activity record on that computer.
- Report pages run no scripts at all, under a strict content security policy.
Security reviews
Bring your questionnaire.
We'll complete your security questionnaire, take your team through the architecture in detail, and agree pilot settings with your security and privacy leads before anything is installed.
Reporting a vulnerability
If you think you've found a security issue in HourBack, email security@hourback.io. Please give us a reasonable chance to fix it before you disclose it publicly. We won't pursue good-faith research that avoids other people's data and doesn't disrupt the service.