How we protect your employees' data

An HR system holds salaries, bank accounts and ID numbers. Here is what Ekansha HRMS does to keep them safe, in plain words.

Each company sees only its own data

Every record belongs to one company, and the server adds that company to every database query. Automated tests that try to read another company's data run before every release.

Sensitive numbers are encrypted

Bank account, PF and ID numbers are encrypted in the database with AES-256-GCM. Payslips and screens show only the last digits of bank accounts.

Permissions checked on every request

The server decides for every request whether your role may see that record: your own, your team's, or everyone's. Hiding a menu is never the only protection, and an old link to someone else's payslip is refused.

Short-lived sign-ins

Sign-in tokens last 15 minutes and renew quietly while you work. Signing out, changing a password or deactivating an employee ends their sessions at once. After 5 wrong passwords, sign-in is paused.

An audit trail of sensitive changes

Changes to salary, bank, ID and PF details, roles, accounts, payroll locks and company settings are recorded with who made them, when and from where.

Files kept out of reach

Payslips and exports are stored outside the web server's public folder. They open only through signed links that expire after a short time. Uploaded files are checked for type and size.

Passwords never stored or logged

Passwords are stored only as bcrypt hashes and never written to logs. Password reset links work once and expire quickly.

Your data, your copy

Your Super Admin can download all of your company's data as a zip file at any time, without passwords in it.

Found a security problem?

Please tell us before telling anyone else, at [email protected], with "Security" in the subject. We reply within two working days.