SECURITY
Technical and Organisational Measures
Annex to the Data Processing Agreement. Article 32 GDPR security measures applied to PersoHR.
This page is the Technical and Organisational Measures ("TOMs") annex referenced in section 7 of the Data Processing Agreement at /legal/dpa. The measures below are those currently in force; they may be updated from time to time, provided that any update does not materially reduce the overall level of security.
1. Hosting and EU data residency
The core HR application uses Hetzner infrastructure for database and file storage. Service providers also support AI features, email, security SMS, billing and public-page analytics. The list at /legal/sub-processors describes each provider's role and processing arrangements. Customer-enabled integrations may send information to the customer's chosen provider. EU hosting of core records should not be interpreted as a statement that every related service or recipient processes exclusively within the EU.
2. Access control and authentication
Customer authentication uses passwordless email links. Magic-link and refresh tokens are stored as hashes; magic links are single-use and expire. TOTP two-factor authentication is required for Owner and HR Admin roles. Recovery mechanisms are subject to separate security checks. Access tokens are time-limited, and refresh tokens are delivered using HttpOnly cookies with production security attributes. Application roles are Owner, HR Admin, Manager and Employee; service-level checks further restrict access to relevant records. These controls do not constitute a claim about hardware keys or operational access reviews on production infrastructure.
3. Tenant isolation
Company HR records are scoped to a tenant, with the authenticated workspace used by repository and service-level access controls. Global user identities can belong to more than one workspace and are handled separately from tenant HR memberships. Record identifiers alone do not grant access; authorisation depends on the authenticated user, workspace, role and applicable relationship checks. Tenant filters are one part of these controls, not a substitute for checking every access path.
4. Encryption
The application uses AES-256-GCM for selected sensitive values, including TOTP secrets and supported payroll banking, tax and social-security identifiers. This is field-level protection and does not mean every salary, document or health field has a separate application-level encryption layer. Traffic between the application and the database stays inside the same server, and every public connection uses TLS. Backups are stored encrypted, while the database volume and document storage have no storage-level encryption. This annex does not assert a particular storage cipher or TLS version for every deployed endpoint without the corresponding operational record.
5. Logging, monitoring and audit
Audit records capture supported actions such as changes, exports and erasure requests, with actor, action, record reference and time information. They are subject to access controls, scheduled retention and specific legal-hold rules. This is not a promise to log every read or retain an immutable, unlimited history. Operational and security logs support investigation and service operation; their contents, access and retention must be limited to the purpose. User and record identifiers may themselves be personal data.
6. Backups and disaster recovery
Appropriate availability and recovery measures form part of the Processor's obligations under Article 32 GDPR. Infrastructure backup schedules, retention, encryption and restoration testing must be documented and maintained for the deployed service. Contact us for the current operational evidence and any agreed recovery objectives. Application data exports are not a substitute for infrastructure backups, and this annex does not represent an independently verified recovery-time guarantee.
7. Incident response
Personal data breaches affecting controller data are reported to the controller without undue delay after awareness, as described in the DPA. Available facts, likely consequences and response measures are supplied and supplemented as the investigation proceeds. The controller's supervisory-notification deadline is separate from the Processor's duty to notify it. Incident investigation and corrective action must protect affected data and preserve necessary evidence.
8. Vulnerability management and secure development
The repositories include automated tests and static quality checks to help detect defects. Identified security issues must be assessed and addressed according to their risk. These development checks do not establish that every dependency is scanned on every build, that external penetration testing has occurred, or that every feature has a completed threat model. Current assessment evidence can be requested from us.
9. Deletion, retention and portability
The service provides user- and employee-data export and erasure workflows, plus an administrative tenant export. Their scope and permissions differ. Erasure routines delete or anonymise supported records. They do not provide a general employer-controlled legal-hold workflow. The customer must assess the lawful response to an individual request. Company-workspace deletion is separate from stopping subscription renewal and has a 30-day cancellation window after the in-app request. Personal-account erasure is immediate and also invokes erasure of associated workspace memberships without a separate employer-approval step. Retained blocked working-time records do not currently have a dedicated retrieval workflow. The DPA governs return or deletion when processing ends, including protected backup copies and required retained records.
10. Sub-processor due diligence
The provider list at /legal/sub-processors describes roles, locations, data categories and vendor agreements. The Processor must engage sub-processors under written terms meeting Article 28 GDPR, remains responsible for the required protections, and must follow the DPA's authorisation, advance-notice and objection procedure.
11. Personnel
Personnel authorised to process customer personal data must be bound by confidentiality obligations and receive access appropriate to their responsibilities. Access management, security awareness and data-handling procedures form part of the Processor's organisational safeguards. The obligation to protect retained personal data continues after an engagement or subscription ends.