Your payroll data, handled properly.
You are about to put your team’s identity documents and salaries into someone else’s system. Here is exactly how they are held.
Roles decide what anyone sees
Admin, HR, manager and employee each carry their own permissions, and you can adjust them per role. An employee only ever reaches their own record — not by being hidden in the interface, but because the server refuses the request.
One company cannot see another
Every query is scoped to the company that made it. Isolation is enforced at the data layer rather than in the screens, so a bug in a screen cannot leak across the boundary.
Documents are stored privately
Identity documents are served through an authenticated route that checks who is asking, and marked never to be held in a shared cache. There is no public URL to guess.
Passwords are hashed, never stored
Hashed with bcrypt at a work factor that stays slow on purpose. A sign-in attempt against an unknown address costs the same time as a known one, so the response cannot be used to discover who has an account.
Sensitive actions are logged
Who changed a payroll figure, who approved a document, who applied a roster plan — recorded with the actor and the time, and readable by your admins.
Encrypted in transit and at rest
TLS on every connection, and an encrypted managed database with automated backups.
Straight answers
What we do not claim.
Two things a buyer usually asks for that we would rather answer honestly than imply.
We are not SOC 2 or ISO 27001 certified yet
The controls described above are in place; the audit is not. If your procurement process needs a certification today, tell us and we will be straight with you about timing rather than sending a questionnaire back with optimistic answers.
We do not stamp CFDI with the SAT
Payroll is calculated and the payslip produced; stamping stays with your accountant or PAC. This matters for compliance planning, so it belongs on the security page as much as the payroll one.
Backups
Automated, with point-in-time recovery on the managed database.
Your data is yours
Export your records at any time. Leaving should never mean losing your history.
Something specific your security team needs to know? Ask us directly