Security & Trust
Tolmete is a delivery intelligence layer. It sits next to your Jira and Git and looks at how work moves: timestamps, statuses, links between tickets and pull requests. It does not open your tickets, read your code, watch anyone's screen, or score your people.
Tolmete is not a monitoring tool, and this page is written so that a developer on your team can check that claim, not just a buyer.
They're product decisions, not policy documents — each one is built into the product rather than promised in a policy.
Jira, Asana, GitHub, Bitbucket, Slack and Teams are connected with read scopes. Tolmete cannot change a ticket, push to a branch, comment on a PR, or post in a channel.
Two things go outward, and only when a person clicks: a calendar invite created from a mitigation plan, and an invoice pushed to your accounting tool. Beyond those two, a write scope in one of our requests is a bug — tell us. Your admin can see and revoke every connection.
Tolmete never receives source code or a diff. It sees that three files changed and forty lines moved; it cannot see which lines. It does read the text around the work — ticket titles and descriptions, PR titles and descriptions, ticket and review comments — because that is how work gets attached to the right project and how a risk gets recognised.
That text is never used to rate a person, and no screen in Tolmete shows what a given person wrote. Direct messages are never read, on any plan.
Signals describe projects, not people. No productivity score, activity ranking, leaderboard or "who is slow" view is computed anywhere in Tolmete.
Where a signal has to mention a person, it is framed as a risk to delivery — never as a cost — and it goes to the admins who can act on it, never to a shared channel. What is per person is the time log, because that is what a timesheet is: hours and a description of the work, never a score.
The Agreement
Field by field. If something you care about isn't on this list, ask and we'll add it.
Read
Jira
Jira or Asana: ticket key, type, status transitions with timestamps, story points and estimates, sprint membership, links between tickets, the assignee and the reporter — and the ticket's title, description and comments, so work can be attached to the right project and a risk can be recognised. Attachments and files are not fetched
GIT
GitHub or Bitbucket: pull request opened / reviewed / merged times, branch names, files changed count, lines added and removed, linked ticket keys, the author — and commit messages, PR titles and descriptions, and review comments, for the same reason: to attach the PR to its project, not to rate the person
Time
Hours logged against tickets, when your team logs time in Tolmete or a connected tracker. Hours are a data point about the project, not a billing unit or an attendance record
Calendar
Google Calendar or Outlook, optional and off by default: event title and agenda, participants, date and duration. The title is what tells us which project a meeting belongs to. Only events you accepted and marked busy are read; private, confidential, out-of-office, all-day and focus-time events are skipped — and Tolmete never joins, records or transcribes a meeting
Chat
Slack or Teams, optional and off by default: messages in public channels, and in a private channel only if someone invites the Tolmete bot and an admin links that channel to a project. Message text is read to see where delivery risk is building, and short excerpts may go to our AI provider when that setting is on. Signals work without chat — connect it only if you want it
Books
Zoho Books, optional: invoice and billing-cycle data to line signals up with what was billed. This is also the one place Tolmete writes outward, and only when a person creates the invoice
Track
Harvest or Clockify, optional: projects, participants and historical time logs, imported when you connect it
Never read
Jira
Attachments and files, and anything in a project nobody has linked to Tolmete.
GIT
Source code and diffs. We see that forty lines moved in three files; we cannot see which lines.
Chat
Direct messages — never, on any plan, under any setting. If chat isn't connected, Tolmete reads nothing there at all
People
HR records, salaries, performance reviews, personal email. Tolmete has no connection to any of them
Device
Screenshots, keystrokes, mouse activity, browser history, idle time, webcam, location, app usage. Tolmete installs nothing on anyone's machine and has no agent, extension or desktop app that could
—
—
Three of our signal types touch individual activity. Here is exactly what each one reads, and the rule that stops it from becoming a way to watch people.
Reads: days since a new contributor's first ticket moved and first PR was opened, against the project's own history. Produces no assessment of the person. Visible to organisation and project admins only — never in shared signals, never in the client portal — and framed as "this person may be blocked": the question it raises is what support is missing, not whether they are slow.
Reads: timestamps of ticket transitions and PR events clustering outside the project's usual hours. Does not log presence, breaks or a start and end of day. It exists to surface burnout and key-person risk to a manager early, as one flag on a date rather than a tally — never as "who works late", and never as a number about the person.
Reads: hours logged against a ticket with no corresponding ticket movement or PR activity. Does not judge whether the hours were real — thinking, meetings and research leave no Git trace, and unverified never means illegitimate. It is framed as a reporting gap on the project ("this work can't be evidenced to the client yet"), it goes to delivery and finance roles who can close that gap, and it never appears in a contributor's own signal feed or in a shared channel.
A signal that is only useful as a judgement about a person doesn't ship. Where a signal has to name someone, it has to name a risk to delivery and a recipient who can remove it. That is a product rule, and it has already killed signal ideas.
Not "we choose not to" — the data model and the interface don't contain these things.
No productivity index, velocity per developer, "focus" percentage or activity rating exists anywhere — not on a dashboard, not in a report, not in an export. Exports carry hours and descriptions, never a score.
No view sorts contributors by output, hours or speed. Signals are listed by project and by consequence to delivery.
No online status, no idle timer, no start-and-end-of-day record. Tolmete has no idea when you are at your desk and doesn't try to. It can see that ticket and PR timestamps cluster outside a project's usual hours, and one signal raises that with a manager as a burnout and delivery risk — never as an attendance note.
No source code, no diffs and no direct messages reach Tolmete at all. The ticket and PR text it does read is used to place the work and judge the risk — and there is no screen, report or export anywhere in Tolmete that shows what a given person wrote. A manager cannot use Tolmete to look over a shoulder, because there is nothing there to look at.
Nothing reaches a client until a manager publishes a portal for that project. When it is published, the client sees contributor names, roles, hours and a client-safe summary of the work — which is why publishing is a deliberate act with an Unpublish next to it. Internal risks and unpublished signals never appear there. Tolmete sends no notification when a portal goes live, so telling the team is your organisation's call, and the Terms require you to give any notice the law asks for.
No agent, no browser extension, no desktop app. All data arrives through read-only API connections your admin can see and revoke.
Written for the developer, designer or PM whose work it reads.
Tolmete sees that a ticket moved and a PR merged, and it reads the text around them — the ticket description, the PR title, the review comments — to place that work on a project. It never sees your source code, your diffs or your direct messages, and no screen lists what you personally wrote. What your manager can see is your time logs: hours, activity and the description of the work — the same records you can open yourself, under your own name, whenever you want.
There is no number attached to you. If a signal involves you at all, it goes to your manager as a project risk — "may be blocked", "may be overloaded" — not as a performance note. Tolmete posts nothing to a team channel, ever, and a client sees only what your manager deliberately publishes in the portal — hours and a client-safe summary of the work, never an internal risk about a person.
Where your team uses Tolmete for time, it's a short message, not a timer. Hours are a data point about the project, used to defend the invoice — not to check whether you were busy.
If something here doesn't match what you see in the product, write to info@tolmete.com. We'd rather fix a signal than have anyone feel watched by it — the anti-surveillance rule is part of why the product exists.
Product rules can change. These are clauses in the Tolmete Terms of Service and Data Processing Agreement that every customer signs.
Terms · AI Outputs
Customers must apply human review and must not use AI outputs as the sole basis for any decision with legal or similarly significant effects on a person — hiring, discipline, compensation or termination. Using a signal as the basis for a dismissal is a breach of the Terms, and Tolmete produces nothing that would support one.
Terms · Acceptable Use
Using Tolmete to monitor individuals in a way prohibited by law, or misrepresenting to staff what data is collected, is a breach of the Terms. Customers must give their people any legally required notice before connecting a source.
DPA
You are the controller of workspace data; we are the processor under a Data Processing Agreement. We hold no rights in your data beyond what's needed to run the service, and we never use it to train AI models — ours or a provider's.
Hosting
Primary data hosting in the EU. Enterprise customers can discuss a specific region.
Encryption
In transit and at rest. Integration tokens are stored encrypted and never exposed in the UI or logs.
Access
Role-based: organisation-level and project-level administrators, contributors, and custom roles an administrator defines. Contributors see their own time logs. Client Portal viewers see only what a PM publishes for that project — internal risks and unpublished signals never.
Retention & Deletion
Disconnect an integration and its data stops flowing immediately. Delete the organisation and it enters a 30-day recovery window, then is permanently deleted within a further 30 days. You can export your data at any time during the subscription.
AI Processing
Detection runs on events, timestamps and the text attached to them. Where a language model is used — summaries, mitigation plans, signal descriptions, and short chat excerpts when that setting is on — it runs through AI sub-processors under data processing agreements, with zero-data-retention configurations applied where available. Your data is not used to train any model, ours or a provider's.
Sub-Processors
Cloud hosting, the AI model provider, payments, application monitoring, support, and the platforms you choose to connect. The current list is in the Privacy Policy and available on request at legal@tolmete.com.
Enterprise
Sign-in with Google is available on every plan. A signed DPA is available to every paid customer, and it gives you the right to commission an independent audit once a year. Security questionnaires: send them, we answer them ourselves.
FAQ
Security review before a pilot is normal. Send it to legal@tolmete.com and the CTO answers it, not a template. Terms of Service, Privacy Policy and DPA are linked in the footer.
