Summary
An earlier version of this article described two-factor authentication as available when it was not, and we corrected it to say so. It is now genuinely built and switched on. Below is how to use it, and an accurate account of everything else protecting your data.
Two-factor authentication: available now
You can now protect your NestedClock account with a code from your phone. Go to Settings → Account → Two-Factor Authentication and choose Turn on two-factor. Scan the QR code with an authenticator app — Google Authenticator, 1Password, Authy and Microsoft Authenticator all work — enter the 6-digit code it shows, and you are done. It works the same way in the mobile app.
Some deliberate choices worth knowing about:
- It is optional. Nobody is forced into it and nothing changes until you turn it on.
- It is for owners and admins. Your staff are not affected — clocking in and out is untouched, and nobody has to install anything.
- Turning it off needs your password and a current code. Someone who finds your laptop already signed in cannot quietly remove it.
- Save your setup key. When you turn it on we show you a key alongside the QR code. Store it in your password manager. There are no printable backup codes, so if you lose your phone that key is the fastest way back in. If it is gone too, contact us and we can turn two-factor off for you once we have confirmed who you are.
If you sign in with Google or Apple, this setting will tell you so and stay out of your way — your two-factor lives with them, and we never handle a password for your account at all.
What actually protects your data today
Every business gets its own database
Your business is not a row in a shared table. Each account is provisioned with its own dedicated database, and every request is checked against the identity in your signed session token before it can read or write. One business cannot reach another's records.
Credentials are encrypted, not just stored
Location kiosk passwords are encrypted with AES-256-GCM — an authenticated cipher, so tampering is detectable, not just unreadable. The encryption key lives in AWS Parameter Store, never in the code. Staff PINs are stored as hashes; the plain PIN is never written to the database.
Your data stays in Australia
All records are stored in AWS's Sydney region. Nothing is replicated offshore.
Backups you can actually restore from
Every business database has point-in-time recovery enabled, so we can restore to any second within the retention window if something is deleted by accident. Time and wage records are held for seven years to meet Fair Work requirements.
The connection itself
The site is HTTPS-only and enrolled in HSTS preload, so browsers refuse to connect insecurely before the first request is even made. A Content Security Policy restricts what code may run, and the app cannot be embedded in another site's frame — which is what stops clickjacking.
Photos are never public
Clock-in photos live in a private bucket with public access blocked at the account level. They are served only through short-lived signed links that expire within the hour, so a copied URL is useless later. They cannot be indexed by search engines.
What you control
- Turn on two-factor authentication — the single biggest improvement available to you, and it takes about a minute.
- Or sign in with Google or Apple, which brings their two-factor with it and means we never hold a password for you.
- Give managers the manager role, not the owner login. Managers can run the day to day without being able to change billing or delete the account.
- Rotate kiosk PINs when someone leaves. A PIN is a convenience credential for a shared tablet, not a password — treat it accordingly.
- Remove staff promptly when they leave, which revokes their access immediately.
Being straight with you
Security pages tend to list everything a product does well and quietly omit the rest. This article once described two-factor authentication we had not built; we corrected it to say so plainly, and then went and built it. That order matters to us — we would rather retract a claim than let it stand. If you are evaluating NestedClock and need a specific control, ask us directly — you will get a straight answer about whether it exists today.
Read more about where your data lives and how accounts are isolated.