Security at Kloqk

Last reviewed November 2026

Kloqk holds hours, pay rates and personal details for the people who work for you. This page says, plainly, how that information is protected today. We only list what is in place now.

Where Kloqk runs

Servers and private file storage at DigitalOcean, in the United States (New York region).
Cloudflare sits in front of kloqk.com and every company workspace address.
The full list of services that process data for us is in our privacy policy.

Encryption

Every page and every request uses HTTPS. Browsers are told to use HTTPS only (HSTS), on kloqk.com and every workspace address.
Traffic between Cloudflare and our servers is encrypted too.
Uploaded documents and punch photos are kept in private storage. They are never public; each view uses a link that expires within minutes.
The secrets behind two-factor sign-in and single sign-on are encrypted by the application before they are stored.

Passwords and sign-in

Passwords are never stored. We keep a salted scrypt hash, which cannot be turned back into the password.
Sign-in codes sent by email work once, expire after 15 minutes, and stop working after a few wrong tries. Repeated attempts are rate limited.
Two-factor sign-in with an authenticator app, on every plan, with single-use backup codes. An owner can require it for everyone who runs the business.
Single sign-on (SAML 2.0 and OpenID Connect) for public sector organizations on Premium, with Microsoft Entra ID, Okta or Google Workspace. A domain must be proven with a DNS record first, and single sign-on only signs in people the organization has already added; it never creates accounts.
The shared time clock does not hold anyone's login. It holds a device key, stored by us only as a hash, and employees punch with a PIN. Switching a time clock off in the dashboard cuts it off at once.
API keys are shown once and stored only as a hash. They can be read-only and can be revoked at any time.

Who can see what

Every record belongs to one business, and every request is checked against the business of the person signed in.
Roles decide what each person can do: owner, admin, manager and employee, with switches the owner controls. Managers can be limited to their own locations, and pay rates are hidden from anyone not allowed to see pay.
Employees see only their own hours, schedule and requests.

Audit logs

Every edit to a punch is recorded with who made it, when, the old and new time, and the reason.
Every settings change is recorded with who made it and what it was before and after.
Sign-ins are recorded with the time, address and device, and a profile shows each employee's activity.
When our support team opens a customer's account to help, a banner says so the whole time, and the visit is recorded permanently.

Accessibility

Security includes being usable by everyone. See our accessibility statement for the WCAG 2.1 AA work and how to report a barrier.

Certifications

Kloqk does not hold SOC 2, ISO 27001 or any other security certification today. If your organization needs a security questionnaire answered, email us and we will answer it honestly.

Report a vulnerability

If you think you have found a security problem, email [email protected] with "Security report" in the subject. Include what you found and how to reproduce it. Please do not access other people's data, run automated scans that slow the service, or share the problem publicly before we have had a reasonable chance to fix it. We will reply within 5 business days and keep you updated until it is fixed. We do not take legal action against good-faith research that follows these rules.