Security

What wHRMS does to protect employee and payroll data, stated as it is built today.

How to read this page

Each item below describes a control that exists in the product or its deployment. The "Not yet" section lists things buyers commonly ask about that we have not implemented, so you are not left to guess.

In transit

  • •Every page and API call is served over HTTPS; plain HTTP redirects to HTTPS at the edge.
  • •Session cookies are marked Secure, HttpOnly and SameSite, so scripts in the browser cannot read them and other sites cannot send them.

Sign-in

  • •Passwords are stored only as salted hashes using Django's password hashing; we never see or store the plain text.
  • •Sign-in tokens live in HttpOnly cookies, not in local storage, and expire; refresh is server-side.
  • •Login, PIN sign-in, registration and password-reset endpoints are rate-limited per client.
  • •Registration verifies the owner's email address with a one-time code before the workspace is used.

Who can see what

  • •Access is role-based with per-module, per-action permissions (view, add, change, delete) assigned per role.
  • •Every business record is scoped to a branch. A branch administrator's queries are filtered to that branch on the server, not in the browser.
  • •Company owners, branch administrators and employees are separate actor types with separate token claims; an employee token cannot call owner endpoints.
  • •Payroll data is behind its own permissions, so approving leave does not grant access to salaries.

Change history

  • •Sensitive records (employees, attendance, leave, payroll) are soft-deleted, not erased, so a mistaken deletion can be reviewed and reversed.
  • •Attendance corrections, employee transfers, salary-structure changes, appraisal approvals and work-calendar changes are logged with who changed what and when.
  • •Payroll runs pass through configurable approval levels and keep their regeneration history.
  • •Application logs are shipped off the server to object storage.

Where data lives

  • •Uploaded files (documents, photos, payslips) are private objects in Amazon S3. Links to them are signed and expire within an hour; the bucket path alone does not open a file.
  • •Card and UPI details never touch wHRMS. Payments are processed by Razorpay and Cashfree; we store the transaction reference only.
  • •Marketing pages and the product run on separate origins; the public site has no access to customer data.

Not yet

  • •We do not currently hold SOC 2, ISO 27001 or a GDPR certification. We will list a certification here only with the certificate.
  • •Multi-factor authentication and single sign-on are not available today. PIN sign-in exists for the employee app; it is a convenience, not a second factor.
  • •We do not publish a recovery-time objective. Ask us for the current backup schedule and restore procedure before you decide.

Report a vulnerability

If you find a security issue, email security@aplenix.com with steps to reproduce. Please do not test against other customers' data; use a trial workspace.

Questions about security?

For a written answer to a security questionnaire, or the current backup and restore procedure:

Email: support@aplenix.com

Phone: +91 098942 45457