Security at HBRX
HR and payroll data is sensitive. This is how we protect it, stated plainly.
On this page
Encryption
- All traffic uses HTTPS (TLS 1.2 or newer).
- Sensitive fields such as bank account, PAN and ID numbers are encrypted in the database with AES-256-GCM, using a separate data key for each company.
- Every uploaded file, payslip and backup is encrypted before it is stored.
- Passwords are stored only as strong one-way hashes (argon2id), never as text.
Each company is kept apart
Every record belongs to one company, and the database itself refuses to return another company's rows to the app. Every new screen and API is tested to make sure one company cannot read another company's data.
Who can see what
Access is set by roles and permissions that your company controls. Bank, PAN and ID numbers are masked by default, and every time someone reveals one it is logged. Salaries are visible only to people with payroll permissions.
Signing in
- Account owners and HR administrators must use two-step sign-in with an authenticator app.
- Repeated failed sign-ins and code requests are rate limited.
- Anyone can sign out of all their devices at once, and new sessions can be reviewed from the app.
Audit trail
Sign-ins, role changes, employee record changes, exports, sensitive views, billing changes and any support access by our staff are written to an audit log that cannot be edited. Your administrators can read it in Settings.
Hosting and backups
The application and database run on servers in India. Backups are encrypted, stored in a separate account and kept for 35 days. Application logs have personal data removed and are kept for 180 days.
Payments
Payments are taken on Cashfree's secure checkout. Card numbers, UPI PINs and bank logins never reach our systems.
What we do not claim
We do not yet hold a security certification, and we do not describe HBRX as certified or "compliant" with any standard. We describe the controls we run, as above.
Reporting a problem
If you find a security weakness, email [email protected] with the details. Please do not test against other companies' accounts or access data that is not yours. We reply within one working day.