Security & privacy
Simple software. Serious security.
Puuunch is a small, focused time tracker — and we built it properly. Your team’s names, hours, and projects run on secure, Canadian-hosted infrastructure, with only the data we actually need to do the job.
- Canadian AWS hosting
- Encrypted in transit and at rest
- Card data never touches our servers
- No trackers, cookieless analytics
- Export your data at any time
Secure infrastructure
Hosted on Laravel Cloud, running on AWS. Traffic is encrypted with TLS, data is encrypted at rest, passwords are hashed with bcrypt behind a 12-character policy, and every query is scoped to your organization so tenants stay separate.
Your data is hosted in Canada
Puuunch uses Canadian AWS infrastructure, helping Canadian businesses meet their privacy and data governance expectations.
Privacy by design
Puuunch only collects the information required to provide the service — no unnecessary employee information, no invasive monitoring, and no surveillance features. Just time tracking.
Your data belongs to you
Every person can download everything we hold about them from Account → Your data. Managers can additionally export the organization’s full records from Settings → Export, and reports to CSV. Delete your organization and it is gone for good after a 30-day grace period — receipts included.
Privacy, without the paperwork
Small teams don’t have a compliance department — so we keep Puuunch’s data footprint small on purpose. That makes your privacy responsibilities easier to meet, in Canada and the United States.
Puuunch helps you manage your responsibilities — it isn’t legal advice.
Who else touches your data
The complete list. Nobody else processes your data on our behalf, and we do not sell or share it.
| Provider | Purpose | What they receive |
|---|---|---|
| Laravel Cloud | Application hosting platform | Runs the app; deployed on AWS. |
| Amazon Web Services | Infrastructure and file storage | Database, application servers and expense receipts, in Canadian facilities. |
| Cloudflare | Delivery network and firewall | Placed in front of the site by our hosting platform. Web traffic passes through it before reaching our servers. |
| Stripe | Payments and invoicing | Billing details and card processing. We never receive your card number. |
| Optional sign-in | Only if you choose “Continue with Google”: your name, email and a Google identifier. | |
| Resend | Transactional email | Your email address and the contents of service emails — verification, password reset, invitations. |
| Laravel Nightwatch | Application monitoring | Errors, performance and logs: the IP address on a request, the technical context of a failure, and the name and email of a signed-in person. |
| Umami | Audience measurement | Page views with no cookies and no personal data. |
If you are an employer using Puuunch for your team, you can ask for a written data-processing agreement. Read the agreement.
Frequently asked
On AWS infrastructure located in Canada. Puuunch is built in Quebec. Some processors handle data outside Quebec — Stripe for payment, Resend for email, Cloudflare for delivery, Nightwatch for monitoring, Google for sign-in — and each is named in the privacy policy.
Yes, in transit and at rest.
No. Card data goes directly to Stripe and never touches our servers.
Only owners and admins. An employee sees their own hours and expenses and nobody else’s.
Yes: a confidentiality incident register, a data processing agreement, and self-serve access and portability. Each person can download their own information, and managers can export the organization’s full records.
It is permanently deleted after a 30-day grace period — receipts included. Export anything you want to keep before then.
Simple to use. Built to be trusted.
Your first week is free and takes about a minute to set up.