Clockgauge sends data between the employee app and your Host over a channel with forward secrecy (X25519 key exchange, AES-GCM encryption), pinned to your Host's identity key so impersonation fails. Screenshots and secrets are encrypted on disk with a key held in the operating system keychain, backups are encrypted with a passphrase, and the dashboard is reachable only from the Host computer.
In transit
- A new key exchange for every connection, so recorded traffic cannot be decrypted later (forward secrecy).
- The Host proves its identity by signing the handshake; the connection code carries the fingerprint the app checks.
- Screenshots go from the employee's computer to the Host directly, not through a relay.
At rest
- Screenshots and the Host's stored secrets are encrypted with AES-256-GCM.
- The key is wrapped by the operating system's keychain where available.
- The employee app encrypts its token and its offline queue.
Access
- The dashboard answers only on the Host computer. Other computers on the network reach only the secure channel endpoint.
- Accounts have roles, lockout after repeated wrong passwords and an audit log.
Backups
Backups are encrypted with a password you choose. The host asks you to choose it and explains it is the key to restore.
What it does not claim
The database itself is protected by your disk encryption (FileVault on a Mac), not by column-level encryption. Security also depends on the Host computer being kept up to date and physically safe. Read the full notes in self-hosted time tracking explained.
Practical steps for the Host computer
- Turn on disk encryption (FileVault on a Mac).
- Use a strong login password and a screen lock.
- Keep macOS and Clockgauge updated.
- Do not share the owner account; add managers separately.
- Back up to an encrypted location.
Questions people ask
Has it had a third-party security audit?
Not yet. An independent penetration test is planned.
Where is data stored?
On the Host computer, in your own data folder.
Try Clockgauge
Clockgauge is an employee and freelancer time tracker that runs on your own computer: timers, consented random screenshots, activity levels, clients, projects and tasks, budgets, payroll balances and reports, paid once instead of per user per month..