Security · Data

Each company's data is kept separate

This product holds employee HR information and contract amounts. That's why we separate data per company (workspace), the server checks on every request that you are an approved member of that company, and inside, access is locked screen by screen.

Separation

Data separated per company (workspace)All data is stored separately per company. Whatever a screen asks the server for, the server first checks that you are an approved member of that company, and refuses if not. If you need it installed separately in your own cloud or on-premise servers, we discuss it as a custom deployment.
Not used for trainingWe do not use customer data for AI training. We process it only within the scope entrusted to us.
A fixed retention period after cancellationWhen the contract ends, we keep your data for 6 months and then destroy it. This period lets you pick up where you left off if you come back; if you want it destroyed sooner, just tell us and we'll delete it right away.

Access control

Sign-ups open only after approvalNo one can get in with just an email address. Requests queue up as pending in the admin console, and an account is created and added to the organization only after approval.
Permissions are per screenView, create, edit and delete are toggled separately for each screen. For example, the org chart can be open to all employees while payroll, revenue and contract amounts are open to C-level only.
Screens with amounts are locked by defaultPayroll, the revenue dashboard, partners and contract details are marked C-level only, and people who can't open them see a lock notice on the screen instead.

Records

Audit logsWho changed what is recorded in the admin console. It's where you check changes that are hard to undo, such as permissions and company settings.
Deletions leave a record, tooCanceling an annual leave adjustment doesn't delete it; it remains as an adjustment with the opposite sign. It's designed so you can see exactly what happened, and other records follow the same principle.
Each approval records who and whenAnnual leave and purchase requests name an approver at submission, and each approval or rejection is recorded per request. It doesn't end with "I told them."

Storage

Passwords are stored one-wayWe store only a bcrypt hash, so even we can't know the original. If you lose your password, we don't tell you what it was — we reset it.
We don't even reveal whether an account existsA login attempt with an email address that doesn't exist goes through the same process as one that does before we respond. This prevents anyone from learning "this address is registered" from how quickly the response comes back.
Session tokens aren't stored in plain form eitherTokens used to stay signed in are stored only as hashes. Even if stored values leak, they can't be used as-is to sign in.

What we don't have yet

We have not obtained ISMS, ISO 27001 or SOC 2 certification. We don't present it as if we had.
Two-factor authentication (OTP) and SSO are not available yet. If you need them, please raise it when we discuss adoption.
IP range restrictions are not available yet.

If you need security review documents or a data processing agreement template, mention it in your inquiry and we'll send them.