Security and data protection
How we protect your employees’ data
HR data is personal. IHR is built so that each organization’s data stays its own, people see only what their role allows, and every important change leaves a trace.
Each organization’s data is kept separate
Every database query is limited to your organization, and membership is checked again on every request. One organization can never see another’s data.
People see only what their role allows
Permissions are checked on the server, not only in the interface. Employees see their own information, team managers their teams, administrators the organization.
An audit log of changes
Changes made by administrators are recorded as they happen: who changed what, and when. Your administrators can review them in the audit log.
Sign-in without passwords
People sign in with Google, Microsoft or a one-time code sent by email, so there are no IHR passwords to steal or reuse. Signing out ends the session at once.
Secrets are stored encrypted
Mail server passwords, Slack and Microsoft Teams webhook addresses and software keys are encrypted with AES-256-GCM and bound to your organization. Equipment and license secrets also use a separate key for each organization.
Encrypted connections only
IHR is served over HTTPS only, with HSTS, and its pages cannot be embedded in other sites.
Hosted in the EU
The application and file storage run on Amazon Web Services in the European Union (Stockholm).
No personal data in technical logs
Our technical logs and error reports carry identifiers and codes only: no names, email addresses or message text.
Your data stays yours
Export reports to Excel or CSV at any time. For a complete copy of your organization, including documents and settings, or when you leave, ask us: we send it in standard formats.
Questions about security?
Tell us what your organization needs to check. We’ll answer your questions or go through them on a call.