Diligence you normally cannot order

You cannot tell from a time tracking product how it was built. This page states what is not left to individual judgement here but enforced by machine — and what we deliberately do not promise.

Your time data never leaves your tenant

In the SharePoint variant, all time data stays in your own SharePoint lists. That is not a pledge but an architectural decision: no time entry, project name or comment is transmitted to our servers. Calls that do leave your tenant are named here — the licence check and the anonymous usage statistics — rather than left out.

  • Time entries, projects and comments stay entirely within your SharePoint lists
  • No calls to external services for business data — not even for public holidays or reference data; those are vetted in advance and embedded into the deployment package
  • On the free plan the licence check transmits your tenant ID and nothing else. A user identifier is added only once your plan bills per seat — and even then, no time data. The result is cached for one hour
  • The anonymous usage statistics contain no content from your time tracking. Your administrator can switch them off in the web part settings — they are then never loaded in the first place, not merely silenced; independently of that, every user can opt out individually
  • The support portal opens only when someone clicks "Report a problem" — it is a link, not a background call. If you run your own support channel, you can point it there
  • For data protection impact assessments: your business data does not cross the tenant boundary, and the calls named above carry none of it. A complete, measured list of every connection the web part makes is available on request

Tenant isolation is a rule, not an agreement

Separation between tenants is not merely documented and well-intentioned — it is verified by machine on every change. Code that violates it never comes into existence.

  • An automated architecture check runs before every push
  • Data access is only possible through a verified interface
  • The build fails if user interface code touches the data source directly
  • The same check applies to the authentication layer

Every architectural decision is on record

Why something is built the way it is does not live in people’s heads but in numbered decision records — with date, rationale and consequences.

  • The practice has been in place since day one, not since the first customer asked
  • Revised decisions stay on record, including the reason for the revision
  • Each record states the consequences, not just the choice
  • Relevant to you if someone else ever has to take Kairox forward

Checks run before the commit, not after

Quality checks are not a nightly report nobody reads — they are a gate. What fails does not get committed.

  • Automated scan for accidentally committed credentials
  • Type checking, linting and tests on every change
  • Limits on file size and duplication that can only be raised deliberately
  • A check that merely reports instead of blocking does not count as a check here

What we do not claim

A page about trust is only worth what it leaves out. So, explicitly:

  • Kairox as a company is not certified to ISO 27001 or SOC 2.
  • In the web app variant your data sits on our servers in the EU — not in your tenant. If you do not want that, choose the SharePoint variant.
  • Team and Business plans are in preparation; today the free plan is available immediately.
  • Kairox is built by a very small human team that makes extensive use of AI tooling — in development as well as in operations. What that means for your risk assessment is your call; we are not hiding it.

How a small team sustains this way of building

Everything on this page is the answer to that. A human cannot review every line — a rule that breaks the build can. That is why tenant isolation and the trust boundary are enforced by machine rather than left to convention, and why every architectural decision is recorded rather than remembered. Not out of tidiness, but because it would otherwise not hold. What the tooling does not take off our hands is the judgement of when something is actually right — a human is accountable for that, and that human reads the code.

What this means for a procurement review

Anyone asking for a certification usually wants to know: where does our data live, and who is accountable for it? For the SharePoint variant the answer is: in your own Microsoft 365 tenant — the infrastructure you have already reviewed and approved. Kairox is software running on it, not another place your data lives. For the web app variant we are a data processor; we provide the details on data flow, storage location and services used for your review. Talk to us before ruling us out — a short conversation often clarifies whether the missing certification actually applies in your case.

Questions about how it is built?

We answer technical questions directly — including the uncomfortable ones. For a data protection impact assessment we supply the data flow details.

View pricing Contact us