How your organisation's data is protected, where it lives, and what we commit to. Written to be handed straight to whoever reviews suppliers for you. Last reviewed 2026.
Passwords are hashed with bcrypt and never stored in a form anyone can read back — not by us, not by your administrator, not by someone who obtains a copy of the database. New staff set their own password on first sign-in. Repeated failed attempts against one address lock that address for fifteen minutes, so a stolen staff list cannot be walked through a dictionary overnight.
Any member of staff can switch on time-based two-step verification (TOTP) and use Google Authenticator, Microsoft Authenticator, 1Password or any compatible app. Eight single-use recovery codes are issued at setup for the phone that is lost or flat. Anyone who can run payroll, see salaries or change settings is prompted until they turn it on. Single sign-on against an existing identity provider is not available.
Reset links are random, stored only as a hash, valid for one hour, and spent on first use. Where an organisation has connected a mail server the link goes to the member of staff directly; where it has not, the request appears in an administrator's queue so it is handed over deliberately rather than lost.
Sessions are held in signed, http-only cookies that JavaScript cannot read, marked secure in production and restricted to same-site use. They expire after eight hours, or thirty days where the person chose "remember me" on a device they own. Every member of staff can see their own recent sign-in attempts, successful and failed, from their profile.
Access is granted by capability, not by job title. Salaries, bank details, payout credentials and system settings are restricted to the owner and finance. HR manages people data; managers see their own team; staff see only their own records. These limits are enforced on the server on every request — not hidden in the interface, where a changed URL would walk straight past them.
Confidential reports made through See Something Say Something are a deliberate exception: they are readable only by the handlers named for them, and identifying a reporter is a separate, logged action that HR alone cannot perform.
Every request is served over HTTPS with TLS 1.2 or better. Certificates are issued and renewed automatically by Let's Encrypt; plain HTTP is redirected, never served.
Databases and backups sit on encrypted block storage provided by our hosting platform (AES-256, managed by the provider). Backup files are written with owner-only permissions. HR247 does not add a second layer of application-level encryption on top: if you require field-level encryption of specific columns, say so before you sign and we will tell you honestly whether we can meet it.
HR247 runs on DigitalOcean infrastructure. Each organisation is a separate application with its own database file on its own volume — not a shared table with a customer column, which is the arrangement most often responsible for one company seeing another's payroll. Nothing is copied to a third country for processing.
The specific data-centre region for your deployment is stated in your service agreement, and an organisation that needs a particular location can be deployed to it.
Paystack secret keys are stored server-side and never displayed back on screen once saved. HR247 transmits them to nobody but Paystack. Card details never touch HR247 at all. Every payout requires explicit approval, and a payout to a changed bank account requires the account to be verified again first.
If we become aware of a breach affecting your data we will contact your named administrator within 72 hours of establishing that it occurred, and tell you what happened, what data was involved, what we have done, and what you should do. We will not wait for a complete investigation before telling you something has happened. Where Nigerian data-protection law requires notification of the regulator, we will make it and copy you.
HR247 has not undergone an independent penetration test or a third-party security audit. It is a young product and we would rather say so than imply a certification we do not hold. Dependencies are updated and reviewed at each release, access controls are exercised as part of testing, and we will commission an external test as the customer base makes it warranted. If your procurement process requires a penetration-test report, tell us early — we will discuss having one done rather than pretend otherwise.
HR247 is built for the Nigeria Data Protection Act 2023. You are the data controller for your staff's records; we are your processor and act on your instructions. Practically that means: we do not sell, mine or share your data; we do not use it to train anything; staff can see and correct their own records inside the product; and on termination you get a complete export and we delete our copies within 30 days.
The complete list of third parties who may touch your data:
| Who | What for | What they see |
|---|---|---|
| DigitalOcean | Servers and storage | Everything, as the host of the encrypted volume |
| Paystack | Salary payouts, where enabled | Name, bank account and amount for each payout |
| Let's Encrypt | HTTPS certificates | Your domain name only |
| Your own mail provider | Password reset and notification email, where you connect one | Only what those messages contain |
Google Play distributes the Android app; it receives no HR data. We will tell you before adding any subprocessor to this list.
We target 99.5% monthly availability, excluding maintenance announced at least 48 hours in advance. Because each organisation runs as its own application, an incident affecting one customer does not take the others down with it. A formal service level agreement with credits is available on the Enterprise plan.
If you believe you have found a vulnerability, tell us through the contact page with enough detail to reproduce it. We will acknowledge within two working days. Please give us a reasonable chance to fix it before publishing. We will not pursue anyone who reports a genuine finding in good faith and does not access or alter data that is not their own.
For anything else, including a completed security questionnaire for your procurement team, use the contact page.