How LogTicks protects your company's data
A plain list of the controls that are in the product and its hosting today, followed by what we do not have. Nothing on this page is a certification.
Sign-in and sessions
Signed access tokens
After sign-in the app holds an access token signed with RS256 (an asymmetric key pair) that expires, and a separate refresh token used only to obtain a new one.
Every API route needs a token
The API refuses a request without a valid token unless the route is on an explicit list of public entry points, such as sign-in, sign-up and password reset.
Google sign-in
People can sign in with their Google account instead of a LogTicks password.
Password reset by expiring link
A reset is done through a link sent by email that expires. The reply on the reset form is the same for every address, so the form cannot be used to find out who has an account.
Bot check on public forms
Sign-up and forgot-password are protected by a Cloudflare Turnstile check where it is configured.
Sign-in lockout
Repeated wrong passwords lock that account and address pair for a minute, doubling up to 15 minutes. The response is the same for an email that has no account.
Password rules
Passwords need at least 8 characters, and common passwords are refused. Changing or resetting a password signs out every other session.
Two-factor sign-in
After the password, a 6-digit code from an authenticator app (TOTP), with 10 single-use recovery codes. A company can require it for managers and admins, or for everyone, and an admin can reset someone who is locked out.
API keys with limits
A personal API key acts as its owner and no more. Keys can be read-only, can expire, and are shown once. Account-security and administration endpoints are closed to keys, and a company can switch keys off.
AI usage quota
AI features have a daily quota for each user, so one account cannot run up unlimited use.
Limits on what the API accepts
API rate limiting
Public endpoints such as sign-in, sign-up, password reset and shared stand-up links are limited per address. Everything else has ceilings per user and per address, tighter for AI, exports, uploads and bulk actions. Over the limit, the API answers 429 with a Retry-After time.
Security headers
Responses carry nosniff, frame deny, a referrer policy, HSTS and no-store, and the API sends a restrictive content security policy.
Uploads and request size
Uploaded files are checked by their content, not only their extension. JSON requests are capped at 1 MB and uploads at 10 MB.
Companies and roles
LogTicks is multi-tenant: many companies share the service and each sees only its own records.
Company-scoped records
Records belong to a company, and the API checks that the record being read or changed belongs to the caller's company before it answers.
Four roles
| Manager / owner | Runs a company: projects, clients, people, approvals, invoices, reports and settings. |
|---|---|
| Member | Logs time, posts stand-ups, requests leave; sees their own data and their teams. |
| Client approver | Sees only the timesheets waiting for their sign-off and their own decisions. |
| Platform admin | VerticalServe staff role for operating the service. |
Audit log
Company Settings has an append-only audit log: sign-ins and failed sign-ins, two-factor and password changes, user and role changes, company settings, timesheet, client and leave approvals, invoice status, share links, report exports and API keys. Each entry has who, when and the network address, with filters and CSV export. Outgoing webhooks are signed with HMAC-SHA256 so the receiver can check they came from LogTicks.
Infrastructure and secrets
Hosted on AWS
The API runs on Amazon ECS, the database is PostgreSQL on Amazon RDS, and this website and the app's files are served from Amazon S3 through CloudFront.
Secrets in AWS Secrets Manager
Credentials are held in AWS Secrets Manager, not in the code. The database password is resolved for each new connection, so it can be rotated without a restart or an outage.
API documentation off in production
The interactive API documentation that the framework can generate is disabled on the production service.
What we do not have
- No third-party security certification or audit report. If your procurement process needs one, LogTicks will not pass it today.
- No enterprise identity-provider sign-in. Sign-in is by email and password, or by Google account.
- Two-factor sign-in is by authenticator app only: no SMS codes and no passkeys. It is not added on top of Google sign-in; people who sign in with Google keep whatever protection their Google account has.
- Rate-limit and lockout counters are kept per server process, not shared across servers.
To report a security problem or ask a question this page does not answer, write to contact@verticalserve.com. How personal data is handled is in the privacy policy.
Questions about security?
Tell us what your review needs. We will answer with what the product does, not with a brochure.