Security at Daypart

A plain-language account of how Daypart protects your team's data: accounts, encryption, where the data lives, what we don't do, and how to report a problem.

Last updated: October 30, 2026

The short version

Daypart holds your team's schedule, names and email addresses, and not much else. Passwords are hashed, traffic is encrypted, two-factor authentication is available, card details never touch our servers, and the whole system is small enough that one person knows every part of it. Found a problem? Email security@daypart.app.

Your account

Passwords are stored as Argon2 hashes, never in plain text, and never logged. We can't read your password and we'll never ask for it.
Email verification is required before a new account can sign in.
Two-factor authentication with an authenticator app is available to every account, on the web and in the iOS app, with one-time recovery codes. Your authenticator secret is stored encrypted, the recovery codes are stored hashed, and each code works once.
Sign-in uses short-lived tokens. An access token lasts fifteen minutes and is refreshed silently; refresh tokens rotate on use and the old one is revoked, so a stolen token has a short life.
Rate limits on sign-in, signup, password reset, two-factor checks and the template download form slow brute-force attempts, and Cloudflare Turnstile keeps automated submissions off the signup and template forms. If someone tries to sign up with an address that already has an account, we email the account holder about the attempt.

Data in transit

Everything is served over HTTPS. The site sends HSTS with a one-year lifetime and preload, so browsers refuse plain HTTP, and certificates are issued and renewed automatically. Pages carry a strict Content Security Policy with per-request script nonces, and the API only answers the web app's origin. The iOS app talks to the same HTTPS API.

Data at rest

Card details never reach us. Payments go through Stripe; we keep your plan and subscription status, not your card.
Secrets are hashed or encrypted. Authenticator secrets are encrypted with a key held outside the database; recovery codes and invitation tokens are stored as hashes.
One database, one server. Your data lives in a PostgreSQL database on a server run by Hetzner in a data center in the eastern United States. The hosting provider keeps rolling snapshots of the server for about a week, which is also how long deleted data can persist in a backup.

Hosting and operations

Access to the production server is limited to the owner. Deploys run through a restricted deploy key that can only execute the deploy script, and every deploy first runs the full automated test suite, including the security tests, as a gate.
Dependencies are audited for known vulnerabilities on every change (the web and API audits run in continuous integration) and updates are applied promptly.
Staging and the analytics dashboard are reachable only over a private network; they are not on the public internet.
Server logs are kept briefly, for security and troubleshooting, and are not shared.

What we deliberately don't do

No advertising or tracking cookies anywhere. No third-party analytics, crash reporting or tracking SDKs inside the app, on the web or on iOS; the marketing pages use a self-hosted, cookie-free analytics tool and the app itself has none. We don't sell data and we don't use it to train AI models. You can export your business's records as CSV and delete your account yourself, without emailing anyone. The details are in the Privacy Policy.

Where we are honest about limits

Daypart is a small company. We don't hold a SOC 2 report or an ISO 27001 certification, we run on a single server rather than a multi-region cluster, and we don't offer customer-managed encryption keys. If your business needs any of those, we'd rather you knew now than after you'd moved your team over.

Reporting a vulnerability

If you think you've found a security problem in Daypart, please tell us before you tell anyone else. Email security@daypart.app with enough detail to reproduce it: the URL or endpoint, the steps, and what you saw. We'll acknowledge your report within 3 business days, tell you what we found once we've reproduced it, treat anything that exposes customer data as the top priority until it's fixed, and let you know when it is.

Please don't access or change data that isn't yours, don't run automated scanners or denial-of-service tests against the live service, and give us a reasonable time to fix the issue before disclosing it. We won't take action against research done in that spirit. We don't run a paid bounty program, but we're glad to credit you when a fix ships if you'd like us to. The same contact is published at /.well-known/security.txt.

Questions

Anything else about how Daypart handles your data: email support@daypart.app or reach us through our site at daypart.app.