End-to-end encrypted, like WhatsApp.
Your timeline is encrypted on your own device. Only your devices have the key. Half5's server only stores and forwards data it cannot read itself.
The key stays with you.
- 1 The key is made on your device
Your first device creates a 256-bit key and keeps it in the system's secure storage, such as the iPhone keychain. That key never goes to the server.
- 2 Everything is encrypted before it leaves
Programs, windows, websites, commits and locations are encrypted on your device with AES-256-GCM. The server only receives unreadable blocks and passes them on to your other devices.
- 3 You link a new device with a code
Like WhatsApp on your computer, you link a new device from one you already have, with a 6-digit code. The code works once, for five minutes. The server sees neither the code nor the key.
- 4 Only approved devices receive anything
The server passes nothing to a device you haven't linked, not even encrypted blocks. You see and remove your devices in the app.
Your key is also kept in your own iCloud Keychain or Google backup, so a new phone can use it straight away. You can also write it down as 24 words. Half5 has no copy, so it cannot recover it for you either.
What is and isn't end-to-end.
Your timeline is yours and is end-to-end encrypted. Whatever you save as an hour, drive or invoice, your team needs to approve and invoice. So it is readable on our server, like with any online accounting software: encrypted in transit and at rest.
End-to-end encrypted: only you
- Programs, windows and websites
- Files and git commits
- AI sessions in Claude Code, Codex or Cursor
- Your location and visits
- Phone calls (number, time and duration)
Server data: you and your team
- Hours, leave and drives you save
- Clients, projects and rates
- Invoices and accounting integrations
- Your account, team and settings
Where your data lives.
Everything is stored in the EU. Which services process anything besides that is listed per service on the subprocessor list.
- Amsterdam Server and database, at DigitalOcean. Encrypted at rest.
- Frankfurt Files and email, at AWS. Encrypted at rest.
- Backups in the EU Every six hours, encrypted before they leave the server, kept unchangeable for 30 days with Cloudflare. The server itself cannot open them.
- Encrypted in transit Every connection runs over HTTPS (TLS 1.2 or newer).
Who can see what.
| Who | Timeline | Hours and drives | Invoices |
|---|---|---|---|
| You | Yes | Your own | As an admin |
| Your manager | No | Their department's | No |
| Admin | No | Whole organisation | Yes |
| Half5 | No | Yes, on our server | Yes, on our server |
AI only sees what you send.
- Recognition happens on your device
Half5 works out which client and project your work belongs to on your own computer or phone.
- Writing a description: only when you tap
When you tap the button, your device sends that hour's window titles and commits to Google Gemini (or OpenAI as a fallback) to write a description. That is the only moment timeline content leaves your devices.
- The help assistant doesn't read your timeline
The in-app assistant (Claude by Anthropic) cannot reach your timeline. An admin can switch it off.
Your account, properly locked.
- No passwords
You sign in with an emailed code, with Apple or with Google. So there is no password that can leak.
- Sign out other devices
Lost or sold one? Sign out every other device and connected AI agent at once in the app.
- AI agents with OAuth
An agent like Claude or ChatGPT gets its own access via OAuth, only to your hours. You revoke that access whenever you want.
Found a security issue?
Email it to [email protected] with ‘security’ in the subject. A report like that goes straight to a person. Give us time to fix it before you make it public.