Security and data protection

Sign-in and sessions

• There are no passwords to leak or reuse. Users sign in with a one-time code sent over WhatsApp to their registered mobile number.
• The code is short-lived, allows only a few attempts, and is stored only as a keyed hash — never as the code itself. Requests are rate-limited per number and per network address.
• An unregistered number gets exactly the same response as a registered one, so the sign-in page cannot be used to discover who works where.
• Sessions renew with rotating tokens. If an old token is ever reused, that whole session family is signed out. In the browser, the renewal token is kept in a cookie page scripts cannot read.

Company isolation

Every request is tied on the server to the signed-in user's own company; nothing in the request can change that. A record belonging to another customer is simply not found. A sign-in belongs to one customer — several legal entities within that customer are managed together, but customers never share a login.

Roles, permissions and scope

• Built-in roles — company administrator, HR administrator, payroll administrator, reporting manager and payment approver — and roles a company defines itself.
• Every permission is checked on the server, not just by hiding a button.
• A role assignment can be scoped to a legal entity, branch, location, department or job title, with effective dates. A permission counts only inside the scope of the assignment that grants it, and an empty scope grants nothing.
• Managers see their own team. Employees see only their own records in self-service.
• Viewing live employee locations and exporting them are separate permissions, granted to nobody by default.

Controls on money and approvals

• Nobody can approve their own leave or attendance correction, administrators included.
• A salary payment batch cannot be approved by the person who prepared it.
• Approving and freezing payroll each need a written note; reopening a frozen month needs its own permission and a reason.
• Applying the reduced PF rate to an establishment needs a second person's approval.

Audit trail

Changes are recorded with who made them, when, from which address and device, and the values before and after. Secrets are redacted from the log and encrypted values are masked in it. Company and HR administrators can view the log.

Access by the HRMSMax team

The HRMSMax team runs the platform from a separate console with separate credentials. To enter a customer's workspace for support, an operator needs a time-limited grant with a recorded reason, and everything done under it is logged against that operator.

Encryption

Aadhaar, PAN, bank account numbers and ID-proof numbers are encrypted in the database with AES-256-GCM, along with stored credentials for integrations. Traffic between browsers or the app and HRMSMax is encrypted in transit over HTTPS.

Privacy and retention

• Employees can request an export or erasure of their personal data from self-service, and administrators process the request.
• Location is collected only between check-in and check-out, only in the tracking mode a company chooses, and only after the employee accepts the tracking notice. Employees can see their own track.
• Retention policies for location history and biometric images delete or anonymise data after a period the company sets, with legal holds.

Certifications

HRMSMax does not currently hold ISO 27001, SOC 2 or similar certifications. Ask us about hosting, backup and data-location arrangements for your deployment.

Questions