Privacy and security

What OneTap keeps, what it never keeps, and how the data is protected.

What OneTap collects

Check-in and check-out times as the server records them, the office matched, and which checks passed.
When a person checks in or out, the office Wi-Fi router's ID and name, and the public address of the request.
At an office with an area set, how far the phone was from the office and how accurate that reading was, never its position.
While the Today screen is open, the app sends the router's ID and, if allowed, the phone's position to show whether the checks would pass, and OneTap doesn't store them.
If a person allows location all the time, the phone says when it leaves the office's area after a check-in, so they can be checked out, and OneTap keeps that time.
The audit trail keeps the public address of the request when a person joins, links a phone or makes a rights request.

No location trail
OneTap keeps no location history and no coordinates of people.
No biometrics
Face ID and fingerprints stay on the phone, and OneTap receives only a signature.
No selling of data
OneTap doesn't sell data, use it for advertising or profile your people.

OneTap stores and processes data in the European Union, in Google Cloud's Belgium region.
It leaves the European Union only for the phone checks Apple and Google run, and in transit across the network edge.

Encrypted in transit with TLS 1.2 or newer, and at rest.
Each company's data is kept apart in the database by row-level security, and that is tested on every change.
Attendance records, edits and the audit trail are chained by hashes, so a change made outside OneTap can be detected.
Oltin's staff reach the operator console only from allowed networks, through single sign-on and an authenticator app, and every action is recorded.

OneTap holds no certification yet.
The security reviews and the penetration test so far were carried out by the team that built OneTap, not by an independent tester.

These documents give the detail, and some of them are still drafts under legal review.

To report a security issue, write to security@oltin.ai.