When you choose an online tool for your company’s time, finances, clients and HR records, you’re trusting it with some of your most sensitive business data. Most buyers ask whether the tool uses HTTPS and whether it has a password policy. Fewer ask a more fundamental question: is our data stored together with every other customer’s data?
How most SaaS tools store your data
The most common design for online software is a single, shared database. Every customer’s records sit in the same tables — your projects next to another company’s projects, your invoices next to theirs. What keeps them apart is a “company ID” column on every row, and code that remembers to filter by it on every single query.
It’s efficient and it works — as long as the code never forgets the filter. A single missed condition in one report or one export is enough for data to appear in the wrong place.
The alternative: a separate database per company
In a database-per-company design, each customer gets its own, separate database. When you sign in, the application connects only to your company’s database. There is no table that contains several companies’ data, so there’s no filter to forget.
That’s how Clocknico is built. When you create a company account, a brand-new database is created just for you. Your projects, time entries, CRM, invoices and HR records live there and nowhere else.
What it means in practice
| Shared database | Separate database per company | |
|---|---|---|
| Separation | A company ID on each row | Physically separate databases |
| Impact of a missed filter | Can expose other customers’ data | Your session only connects to your database |
| Closing your account | Rows deleted table by table | The whole database is removed |
Isolation isn’t only about the database
Uploaded files deserve the same care. In Clocknico, receipts, sick notes and other uploads are stored in a folder per company, and every download is checked against the company of the person requesting it.
Other questions worth asking any vendor
- Who inside my company can see what? Clocknico has owner, admin, manager and member roles plus departments; cost rates and profitability are visible to managers and admins only, and medical documents only to admins and the employee.
- How do people sign in? Google or Microsoft sign-in, or passwords stored only as a strong one-way hash, with repeated failed attempts rate-limited.
- Is all traffic encrypted? Clocknico uses HTTPS with HSTS, and secure, HTTP-only session cookies.
- Can I get my data out? Time data can be exported to CSV at any time.
The bottom line
Architecture is one of the few security properties you can’t add later with a setting. If your business data matters to you, ask where — and next to whom — it’s stored. Read more on our security page, or create a free company account and see for yourself.