Answers for your IT team
The questions IT departments usually ask about Lifetick, answered: hosting, encryption, sign in, access, backups, monitoring and the companies we use.
This page answers the questions IT teams most often ask before they approve a new app. If your organisation has its own questionnaire, email [email protected] and we'll help you fill it in.
The basics
Who makes Lifetick? Meridian 86 Pty Ltd (ACN 130 864 121), an Australian company.
What is it? A web app at lifetick.com and an iPhone and iPad app. Both use the same account and the same data. There's nothing to install on your servers or computers.
What does someone need to use it? An email address and a current web browser, such as Chrome, Edge, Safari or Firefox. The iPhone and iPad app needs iOS 18 or later. There's no Android app, but the web app works in a phone's browser.
Hosting and data location
Where is the data stored? On servers we run with Linode (part of Akamai) in the USA. The database, the files people upload, such as goal pictures, and the backups are all there.
Can we choose another country? No. All Lifetick data is stored in the USA.
Is it backed up? Yes. The database is backed up every 24 hours and backups are kept for 7 days, in the USA.
Is it single-tenant? No. Organisations share one Lifetick database, and the app keeps each organisation's people and data apart.
Encryption
In transit. Every connection to the website, the web app and the iPhone app uses HTTPS.
At rest. The database isn't encrypted at rest.
Passwords. Stored hashed, never as plain text. People who sign in with Google, Microsoft, Apple or your single sign-on have no Lifetick password at all.
On the iPhone. The app keeps your sign-in in the iPhone's Keychain. It keeps only a small cache of recent data, which is cleared when you sign out.
Card details. Card numbers go straight from the browser to our payment provider, which gives us a token in their place. Lifetick never stores card numbers.
Signing in
People can sign in with an email and password, or with Google, Microsoft or Apple. Organisations can also have everyone sign in through their own identity provider with single sign-on. See Sign in options for your organisation.
Two-step verification. Lifetick doesn't have its own two-step verification. If you need it, have your people sign in with Microsoft or Google, or turn on single sign-on, so your own sign-in policy applies.
Password guessing. Sign-in is limited to 10 tries for an email address every 15 minutes, and 30 tries from one internet address a minute.
Sessions. A web session lasts 30 days from the last time someone used Lifetick. Signing out ends it straight away, and changing a password signs out the person's other browsers within 5 minutes.
Access and permissions
Each person has a role that decides whose goals they can see, and admins run the organisation's settings. Each person can keep goals private from their manager, and journal notes are always private. See Access controls and leavers.
Integrations
Directory sync. Lifetick doesn't sync people from Active Directory, Entra ID or Google Workspace, and doesn't support SCIM. Add people with an invite link, by email, or by uploading a spreadsheet.
API. There's no public API. Larger organisations can talk to us about custom integrations.
Exports. Admins can download goals, tasks and journal activity for everyone as CSV files. See Export your data.
Monitoring and email
Errors. We use Sentry to tell us when something breaks on the website, the server or the iPhone app. We remove sign-in codes and invite tokens from web addresses before they're sent.
Email. Lifetick's emails, such as check-ins, reminders and invites, are sent through Mailgun from [email protected]. They're signed for our sending domain, mg.lifetick.com, so they pass SPF, DKIM and DMARC checks for lifetick.com. If your mail filters block unknown senders, allow [email protected] and the domain mg.lifetick.com. Mailgun's open and click tracking is turned off. Some automated emails, such as tips, include a small image and a sign in link so Lifetick can count opens and clicks itself. Account emails such as password resets and invites aren't tracked.
Companies we use
| What for | Company | Where |
|---|---|---|
| Hosting, database and backups | Linode (Akamai) | USA |
| Sending email | Mailgun | USA |
| Error reports | Sentry | USA |
| Sign in, if people choose it | Google, Microsoft, Apple | |
| Organisation single sign-on | WorkOS | |
| Card payments on the web | Pin Payments, PayPal | |
| App Store subscriptions | Apple | |
| Website visits | Google Analytics | |
| Website chat and contact forms | HubSpot |
Google Analytics and HubSpot are used on the public website, not inside the app.
Certifications and guarantees
Lifetick doesn't have SOC 2 or ISO 27001 certification. The Team plan doesn't come with a written uptime guarantee. If your organisation needs either, talk to us about our Professional or enterprise plans.
Privacy
We handle personal information under the Australian Privacy Act 1988 and the Australian Privacy Principles. See Privacy answers for your organisation, and our privacy policy for the full terms.
