🏠 Home
Build Hope
Help every family have a place to call home — funded through OseloHelp.com, our tax-exempt non-profit corporation.
Security and Your Data
How TimTim.Live keeps partners, buyers and their data safe. Everything on this page is how it works today.
Keys and signing in
- We show a secret key only once. We keep only a scrambled copy (a SHA-256 hash), so even we cannot read it.
- Test keys and live keys are separate. Test keys only see sample events and never touch real money.
- A website key only works on the websites you list for it.
- You sign in with a one-time link sent to your email. There is no partner password to steal.
- Each person on your team has their own login and only the access their job needs.
Extra locks for big partners
- OAuth 2.0: trade your client ID and secret for a token that lasts one hour.
- Server address locks: a key only works from the servers you list.
- Certificate locks (mTLS) on api.timtim.live: a key only works with your own TLS certificate.
Data on the way
- Every TimTim.Live address uses HTTPS. Browsers are told never to use plain HTTP with us.
Messages we send you
- Every webhook is signed with HMAC-SHA256 and the time it was sent. Refuse anything older than five minutes.
- Your webhook secrets are stored encrypted (AES-256-GCM).
- We never send messages to private or internal network addresses, and we never follow redirects.
Buyers and payments
- We never give partners a buyer's name, email, address, phone number or card details.
- Card payments happen on Stripe's own secure checkout page. Card numbers never reach TimTim.Live's servers.
- Buy links are signed, so nobody can fake a link to take your credit.
Where data lives
- Our main server is in France, in Lauterbourg (Contabo).
- These services handle data for us: Stripe (payments), Cloudflare (network protection), Contabo (servers), Oracle Cloud (backup server) and Resend (email).
How long we keep things
- Webhook delivery history: 30 days.
- Ended OAuth tokens: one day, then deleted.
- Status checks: 90 days.
- API use is counted per day. We never store your keys or what you send in those counts.
Watching for problems
- We check every public part every minute from the internet. You can see the results on our status page.
- Our team gets an alert if the site stops answering.
- Approving partners and sending money need a named staff member with that permission. There is no shared password for them.
What we do not have yet
- We do not have a SOC 2 report or an ISO 27001 certificate yet.
- No outside company has tested our security yet (a penetration test).
- We do not run a paid bug bounty program.
- We will update this page when any of that changes.
If something goes wrong
- If a key may have leaked, switch it off on your dashboard. It stops working at once. Then make a new one.
- Found a security problem? Email [email protected]. A real person reads every report.
- Please do not test on other people's data, and give us time to fix a problem before you share it.
