Security at StaffPlace

Protecting your employee data with enterprise-grade security controls aligned to international standards.

✓
ISO/IEC 27001:2022
Aligned
✓
NDPR
Compliant
✓
GDPR
Ready
✓
SOC 2
In Progress
🔐
AES-256
Encrypted
52
Security Controls
8
ISO 27001 Domains
6
Access Levels
24/7
Monitoring

🔑 Authentication & Access Control A.8.5 / A.5.15

Multiple layers of authentication and granular access control protect every account.

✓
BCrypt Password Hashing — Passwords are never stored in plaintext. Industry-standard BCrypt with salt.
✓
Password Policy — Minimum 8 characters with uppercase, lowercase, and number required.
✓
Rate Limiting — 5 failed login attempts triggers a 15-minute account lockout.
✓
Two-Factor Authentication — Email OTP verification with 6-digit code, 10-minute expiry.
✓
Secure Password Reset — Cryptographic token with 1-hour expiry. One-time use only.
✓
6-Level RBAC — Platform Owner, Admin, HR, Viewer, Manager, Staff. Each with distinct permissions.
✓
Module Permissions — Granular View/Edit/Delete flags per role per module.
✓
Session IP Binding — Sessions invalidate automatically if the client IP address changes.

🔐 Encryption & Data Protection A.8.24

Data is encrypted both in transit and at rest using industry-standard cryptography.

✓
SSL/TLS in Transit — All connections encrypted via Cloudflare SSL. HTTPS enforced on all endpoints.
✓
AES-256-CBC at Rest — PII fields (bank details, tax IDs) encrypted with AES-256 before storage.
✓
Secure Cookies — HttpOnly, Secure, and SameSite=Lax flags on all session cookies.
✓
HSTS Enforcement — Strict-Transport-Security header with 1-year max-age and includeSubDomains.

📋 Logging & Monitoring A.8.15 / A.8.16

Comprehensive audit trails and real-time alerting for security events.

✓
Login Audit Trail — Every login attempt recorded with email, IP, user agent, success/fail, timestamp.
✓
API Audit Trail — All write operations logged: who changed what, when, from which IP.
✓
Profile Change Audit — Field-level tracking of every employee profile modification.
✓
Failed Login Alerts — Admin notified by email after 5+ failed login attempts.
✓
New Admin Alerts — All admins notified when a new admin user is created.
✓
Export Alerts — Admin notified when bulk data exports are performed.

🛡️ Data Privacy & Masking A.8.11

Sensitive data is masked in the UI and protected by strict access policies.

✓
Bank Account Masking — Displayed as ****1234 to non-privileged users.
✓
Tax ID Masking — Displayed as ***456 in the interface.
✓
Multi-Tenant Isolation — Each organisation's data is completely isolated at the database level.
✓
Data Portability — Staff can export all personal data (GDPR right to portability).
✓
Organisation Export — Admins can export full organisation data in JSON format.
✓
Cookie Consent — Essential cookies only. No tracking or advertising cookies.

⚙️ Secure Development A.8.25

Security is built into the development process, not bolted on afterwards.

✓
X-Content-Type-Options — Prevents MIME type sniffing attacks.
✓
X-Frame-Options — Prevents clickjacking by blocking iframe embedding.
✓
XSS Protection — Browser-level cross-site scripting filter enabled.
✓
Referrer Policy — strict-origin-when-cross-origin to prevent data leakage.
✓
Permissions Policy — Camera, microphone, and geolocation disabled by default.
✓
Parameterised Queries — All SQL queries use prepared statements to prevent injection.
✓
Input Sanitisation — All user inputs sanitised with dedicated helper functions.
✓
CSRF Protection — Cross-site request forgery tokens on state-changing operations.

💾 Backup & Recovery A.8.13

Automated backups with integrity verification ensure your data is always recoverable.

✓
Daily Database Backup — Automated gzip-compressed PostgreSQL dumps every day at 2 AM.
✓
Daily Files Backup — Application code and configuration backed up daily.
✓
Weekly Uploads Backup — Document uploads backed up every Monday.
✓
SHA256 Checksums — Integrity verification hash generated for every backup file.
✓
30-Day Retention — Backups retained for 30 days with automatic cleanup of older files.

🔒 Session Management A.8.9

Sessions are managed securely with automatic expiry and anomaly detection.

✓
8-Hour Session Lifetime — Sessions automatically expire after 8 hours of inactivity.
✓
IP Binding — Session invalidated immediately if client IP address changes.
✓
Strict Session Mode — Only server-generated session IDs accepted.

👥 Access Control Architecture A.5.15

Six distinct access levels ensure the principle of least privilege is enforced throughout.

1
Platform Owner — Controls modules and role templates across all organisations.
2
Organisation Admin — Manages users, assigns roles, configures org settings.
3
HR User — People and payroll modules. No settings access. No delete permission.
4
Viewer — Read-only access to permitted modules only.
5
Manager — Staff portal plus ability to review direct reports' appraisals.
6
Staff — Self-service portal. Own data only: payslips, claims, leave, profile.

Questions about security?

We take data protection seriously. Contact our security team for detailed information.

Contact Security Team
Privacy Policy Terms of Service