Security Exhibit / Security Whitepaper

Document ID: TC-LEGAL-004 Title: Security Exhibit Version: 1.1 Last updated: 2026-10-24 Publisher: Timecampus Technologies Pvt. Ltd. (Burdenoff Group) Canonical location: https://burdenoff.com/contracts/timecampus/TC-LEGAL-004 Burdenoff Group Contract Registry — root at https://burdenoff.com/contracts (one subgroup per product). The contracts referenced in this document belong to the TimeCampus subgroup at https://burdenoff.com/contracts/timecampus/. Every referenced contract is identified by its Document ID (TC-LEGAL-### / TC-PRICING-###) and incorporated by reference.

Status: Published v1.1 — effective 2026-10-24. Reviewed against the production platform and approved for publication by the founder (India jurisdiction); outside-counsel review checkpoints are tracked in TC-LEGAL-REG. Incorporated by reference into the MSA, DPA, and Order Forms unless explicitly varied.

1. Overview

TimeCampus is a multi-tenant SaaS time-intelligence platform processing employee, team member, expense, document and (where enabled) monitored-activity data. Timecampus designs and operates the Service following defence-in-depth principles across (a) cloud infrastructure, (b) container platform, (c) application code, (d) data layer, (e) operator access, and (f) supply chain, with heightened controls around sensitive time-and-activity data.

Operating model. Timecampus is the contracting party. The Burdenoff Group's manpower house — Burdenoff Consultancy Services Pvt. Ltd. — employs the engineering, support, security, and operations personnel that operate the Service under Timecampus's instructions and the Group's intra-group confidentiality and data-protection arrangements. Data and compute run on managed cloud services (Amazon Web Services, ap-south-1 Mumbai) acting as Subprocessors per DPA Annex 3.

Platform reuse. TimeCampus runs on the shared Burdenoff platform and reuses common platform services (identity/RBAC, files/documents, tags, comments/threads, tenancy, billing, notifications). It inherits the platform's tenant isolation, RBAC and security model.

This Exhibit describes the controls in force. Specific commitments (e.g., RPO/RTO, retention, residency, customer-managed keys, team-data localisation) are set on the Order Form. No certification beyond what is expressly listed here is claimed; ISO/IEC 27001 and SOC 2 Type II are on the roadmap and not in force at the date of this Exhibit.

2. Organisational controls

ISO/IEC 27001-aligned ISMS (certification roadmap — see Risks).
Information Security Lead reporting to senior management.
Security risk register reviewed quarterly.
Documented policies for access control, asset management, change management, incident response, business continuity, vendor management, secure development, acceptable use.
Mandatory annual security and privacy training, including secure handling of team, expense and billing and document data; phishing simulations.

3. Personnel

Confidentiality undertakings on all employees and contractors.
Personnel screening for roles with production access, subject to local law.
Access revocation within 24 hours of member removal.
Separation of duties for production change deployment vs. approval.

4. Identity and access management

Layer	Control
Internal SSO	SSO with MFA mandatory; no shared accounts
Cloud admin	MFA enforced on AWS root and admin
Production	RBAC; datastore access only through SSM-managed bastions, with writes requiring individual SSO identity; Cloudflare Access on pre-production surfaces
Secrets	AWS Secrets Manager per environment; access scoped by role
Customer-facing	RBAC enforced at the gateway via GraphQL `@rbac` directives; heightened restrictions on expense/document/monitored-activity data; SSO/SAML/OIDC and SCIM available on Enterprise

5. Encryption

Data state	Mechanism
In transit	TLS 1.2+ on all public endpoints; HSTS; certificate-verified TLS (verify-full) from services to managed databases
At rest	AES-256 for primary databases (Amazon RDS PostgreSQL), ElastiCache Valkey (where supported), object storage
Application-layer	Signing keys and tenant secrets encrypted with AES-256-GCM
Key management	AWS Secrets Manager per environment; rotation policies; customer-managed keys available on Enterprise

6. Network architecture

Production runs on AWS EKS (ap-south-1) per environment with private networking and environment segregation.
Public traffic: Cloudflare WAF → API gateways (GraphQL Yoga + Apollo Federation v2).
Internal-only traffic: internal API gateways behind private ingress; M2M via internal gateways only.
Default-deny network policies; egress restricted to approved destinations.

7. Application security

Secure SDLC: PR review, GitHub Actions CI with GitHub OIDC to AWS.
Static analysis on CI; dependency scanning; secret scanning.
Build-time container scanning with Trivy (CVEs, IaC misconfig, SBOM).
Image scanning in Amazon ECR (scan on push).
Strict input validation; GraphQL query depth/cost limits and RBAC at gateway; parameterised DB access via Prisma.
Strict TypeScript; no any, no eslint-disable, no @ts-ignore in repo standards.

8. Multi-tenancy and data isolation

Logical tenant isolation by organisation / workspace ID; RBAC enforcement at the resolver layer.
Heightened access controls around expense, document and monitored-activity data.
Storage and API request quotas applied per account.
Dedicated tenant deployment available on Enterprise.

9. Logging, monitoring, audit

Centralised logs, metrics and traces with dashboards.
Customer-visible audit history per Plan; time-and-record actions (record edits, expense and billing changes, document access) are auditable; longer retention for Enterprise.
Security event monitoring with on-call rotation (best-effort outside business hours for non-Enterprise tiers).
Burdenoff Group status page at https://status.burdenoff.com publishes uptime and incident status for all Burdenoff Group products, including TimeCampus.

10. Vulnerability and patch management

Continuous CVE scanning of base images and dependencies.
Patch SLO: critical within 7 days, high within 30 days, medium within 90 days, subject to operational risk.
Annual third-party penetration test (target — see Risks).
Coordinated vulnerability disclosure programme at security@burdenoff.com, published with security.txt at https://timecampus.com/security.

11. Backup and disaster recovery

Item	Detail
Database backups	Automated, encrypted; hot tier rolling 30 days
Long-term backups	Cold tier up to 90 days
BCP / DR test	At least annually
Default RPO / RTO	RPO 24 hours / RTO 24 hours
Enterprise commitment	RPO 1 hour / RTO 8 hours (subject to deployment mode)

12. Incident response

Documented IR playbooks with severity classification (SEV-1 to SEV-4).
On-call rotation.
Customer notification within 72 hours of confirmed Personal Data Breach.
Post-incident review and root-cause analysis shared with affected Customers under NDA.

13. Compliance and certifications

Item	Status
ISO 27001	Roadmap
SOC 2 Type II	Roadmap
GDPR / DPDP Act readiness	DPA available
PCI-DSS	Out of scope (payment processing and billable projects payments delegated to Stripe / Razorpay)
HIPAA / BAA	Not supported by default; case-by-case Enterprise review
Employment-AI (NYC employee-monitoring-disclosure, EU AI Act high-risk)	Customer (deployer) carries monitoring-transparency assessment and team member-notice obligations; Timecampus provides reasonable feature information
CERT-In directives (CERT-In 2022)	Timecampus complies with applicable Indian CERT-In reporting requirements (see TC-LEGAL-004A)

14. Subprocessors

See TC-LEGAL-003C — DPA Annex 3 (Subprocessors). The live, authoritative list is published at https://timecampus.com/subprocessors.

15. Customer responsibilities (shared responsibility)

Timecampus	Customer
Service infrastructure and platform	Lawful basis, consents and notices for team data
Service-level RBAC primitives	Customer's RBAC / SSO configuration and access reviews (esp. expense/document/monitored-activity data)
Encryption of Customer Data at rest/in transit in the Service	Encryption / control of Customer Data outside the Service (exports, downloaded reports)
Tenant isolation in multi-tenant SaaS	Workspace-level access management within the tenant
AI-assist feature operation	Human-in-the-loop review of AI-assisted decisions; deployer monitoring-transparency assessment / team member-notice duties
Backups of Service data	Independent records of expense and billing and statutory employment data
Relaying verification requests to enabled providers	Choice of integration provider; lawful basis for monitoring

16. Reporting

Status page (group-wide): https://status.burdenoff.com — publishes status for all Burdenoff Group products including TimeCampus
Security contact: security@burdenoff.com (Burdenoff Group security mailbox; monitored by the Burdenoff Consultancy security personnel that operate the Service on Timecampus's behalf)
Vulnerability disclosure: same address; PGP key on request
DPO / Grievance Officer (DPDP Act): Vignesh T.V., Founder, CEO & CTO of Timecampus — contact@timecampus.com

17. Changes

This Security Exhibit may be updated provided the overall level of security is not materially diminished. Material changes will be notified through standard channels.

Reference and incorporation

All Burdenoff Group contracts, addenda, exhibits, policies and registers referenced in this document are identified by their Document ID (TC-LEGAL-### or TC-PRICING-###) and are published at https://burdenoff.com/contracts. Each such referenced document is incorporated into this document by reference. The version of a referenced document that applies is the version published at https://burdenoff.com/contracts as at the Effective Date of the applicable Order Form (or, where no Order Form exists, the version current at the date of acceptance), unless an executed Order Form specifies a frozen version.