Security and privacy by design

Your people data deserves care. Here is how we handle it.

Custom roles with scopes: own data, own team or everyone. A change that grants more than you hold is refused.

Personal and sensitive data, storage credentials, two-factor secrets and webhook secrets are encrypted at rest.

Documents live in your Cloudflare R2, Backblaze B2 or Amazon S3 bucket, with short-lived download links.

Sensitive reads and settings changes are recorded and searchable by organization admins.

You choose how long reports, tasks and logs are kept. Documents of people who left can be deleted after a period you set.

Bring your own key. Names and ids are anonymized, outputs are validated, and nothing is used to score people.

Support access to your organization follows your setting, is time-limited and is logged. Staff accounts need two-factor sign-in.

Data is stored in the Americas. We build around Ecuador's data protection law and GDPR principles, and publish our sub-processors.

Questions about security or data protection? Write to us from the support page.

Start with one team. Grow into the platform.

Create your organization in a minute and turn on the modules when you need them.