Security and data protection
How we protect your employees’ data
HR data is personal. IHR is built so that each organization’s data stays its own, people see only what their role allows, and every important change leaves a trace.
Each organization’s data is kept separate
The server limits queries for your data to your organization and checks membership again on every request, so each organization works only with its own data.
People see only what their role allows
Permissions are checked on the server, not only in the interface. Employees see their own information, team managers their teams, administrators the organization.
An audit log of changes
Changes made by administrators are recorded as they happen: who changed what, and when. Your administrators can review them in the audit log.
Sign-in without passwords
People sign in with Google, Microsoft or a one-time code sent by email, so there are no IHR passwords to steal or reuse. Signing out ends the session at once.
Passwords and keys you store are encrypted
Mail server passwords and Slack and Microsoft Teams webhook addresses are encrypted with AES-256-GCM and bound to your organization. Equipment passwords and license keys are encrypted too, with a separate key for each organization.
Encrypted connections only
IHR is served over HTTPS only, with HSTS, and its pages cannot be embedded in other sites.
Secure hosting
The application and file storage run on established cloud infrastructure, and connections from your browser use HTTPS.
No personal data in technical logs
Our technical logs and error reports carry identifiers and codes only: no names, email addresses or message text.
Your data stays yours
Export reports at any time: the payroll report to Excel, other reports to Excel or CSV. For a complete copy of your organization, including documents and settings, or when you leave, ask us: we send it in standard formats.
Questions about security?
Tell us what your organization needs to check. We’ll answer your questions or go through them on a call.