H HRIMS
Security & Compliance · posture brief
Human Resource Information & Management System

Security, stated plainly.

An HR platform holds the most sensitive data a company keeps — salaries, bank details, government IDs. This is an honest account of how HRIMS protects it: what is enforced in the running system today, and what is on the roadmap. No control is listed here unless it is actually in the code.

architecturesingle-tenant · one isolated instance & database per client
data in transitTLS 1.2 / 1.3 only · HSTS 1 year + preload
credentials at restAES-256 encrypted · bcrypt (cost 12) password hashing
authenticationMFA (TOTP) available on every account · RBAC enforced in the data layer
supply chainDependabot · CodeQL SAST · secret scanning · audit gate on every push
100%
Stored credentials encrypted at rest (AES-256)
0
High-severity dependency advisories
15 min
Access-token lifetime · 7-day rotating refresh
1 : 1
Client-to-instance isolation — no shared database
Verified in source

Security controls

Each row reflects a control implemented and enforced in the current codebase. Status is exact — Enforced means live today; Planned means committed roadmap.

Identity & Access
Role-based access control
Permission matrix per role, enforced at the query layer — confidential records are absent from the database results for unauthorized roles, not merely hidden in the UI.
Enforced
Session tokens
Short-lived 15m access tokens with 7-day rotating refresh tokens, stored server-side and individually revocable. Signing secrets required to be ≥ 32 characters.
Enforced
Password security
bcrypt hashing at cost 12; server-side policy (length, letter, number, symbol); admin-issued temporary passwords force a change before any other action.
Enforced
Brute-force protection
Two layers — a dedicated IP-keyed limiter on the login, MFA and password-reset endpoints, and a per-account lockout that freezes a single account after repeated failures no matter how many source addresses are used. Lockout auto-expires; an admin can clear it. Reset on any successful sign-in.
Enforced
Multi-factor authentication
Time-based one-time passcodes (TOTP, RFC 6238) as a second factor — works with any authenticator app. Single-use backup codes for recovery; the secret is AES-256 encrypted at rest and verified before enrollment completes.
Enforced
Enterprise SSO
SAML 2.0 / OIDC federation with corporate identity providers (Okta, Azure AD, Google Workspace).
Planned
Data Protection
Credentials encrypted at rest
Every stored secret — SMTP, per-user mailbox, AI provider keys, cloud-storage credentials — is AES-256 encrypted and never returned by any API response.
Enforced
Authenticated file access
Documents, payslips and IDs require a valid session; only public branding is served anonymously. Files leaving the server never carry a referrer that exposes their URL.
Enforced
Confidential employee records
Designated records (salary, personal data) are invisible to HR and managers across every listing, report and export — visible only to the CEO and Super Admin, enforced in the data layer.
Enforced
Tiered, durable storage
Recordings and documents write to server disk, then move to encrypted-at-source network storage with verified copies — surviving every redeploy.
Enforced
Data-subject export & erasure
Self-service JSON export of everything held about a person (GDPR Art. 15/20, DPDP). Right-to-erasure anonymizes identifying data in place — name, contact, IDs, bank, biometrics, documents, recordings, activity — while preserving statutorily-retained payroll and attendance records, pseudonymized. Erasure is Super-Admin-only, password + code confirmed, and irreversible.
Enforced
Secrets vault & rotation
Move deployment secrets from environment files into a managed KMS / vault with scheduled rotation.
Planned
Application & Transport
TLS everywhere
TLS 1.2 / 1.3 only, HTTP redirected to HTTPS, HSTS with a one-year max-age and preload.
Enforced
Security headers
Managed via helmet — X-Frame-Options: DENY, nosniff, no-referrer policy, cross-origin isolation.
Enforced
Input validation
Schema validation (Zod) on API inputs; unknown fields are stripped rather than trusted.
Enforced
Untrusted-content isolation
Rendered email and remote HTML run inside a fully sandboxed iframe, kept out of the application context.
Enforced
Infrastructure & Supply Chain
Hardened containers
Application runs as a non-root user with no-new-privileges; database and cache are never exposed to the host — reachable only on the internal network.
Enforced
Dependency & code scanning
Automated on every push — Dependabot updates, CodeQL static analysis, secret scanning, and a build-failing audit gate on high-severity advisories.
Enforced
Full audit trail
Security-relevant actions — role changes, resets, record access, configuration — are recorded with actor, time and context.
Enforced
Backup-first deploys
Every deployment snapshots the database and uploads before applying changes; migrations are additive and non-destructive.
Enforced
Built on

Technology stack

Mainstream, well-supported components — no exotic dependencies for a security team to vet from scratch.

Backend

  • Node.js 20 LTS
  • Express + TypeScript strict
  • Prisma ORM 5.x
  • PostgreSQL 16
  • Redis 7

Frontend

  • React 18
  • Vite build
  • TailwindCSS 3
  • TanStack Query data
  • Zustand state

Infrastructure

  • Docker Compose multi-stage
  • nginx TLS term
  • Let's Encrypt auto-renew
  • Desktop agent Win · macOS · Linux
  • GitHub Actions CI
Deployment model

One client, one instance

Single-tenant by design

Every customer runs on their own isolated instance with a dedicated database — there is no shared multi-tenant store where a query bug could cross customer boundaries. Data can be hosted on infrastructure the client controls, which keeps data-residency and sovereignty decisions in their hands rather than a vendor's. It is the strongest isolation guarantee a deployment can offer, and it is the default here.

Regulatory posture

Compliance, honestly

As a processor of employee personal data, HRIMS is built toward GDPR and India's DPDP Act. Here is exactly where that stands.

In place
  • ◆Multi-factor authentication — TOTP second factor with backup codes.
  • ◆Access control & least privilege — role-scoped, data-layer enforced.
  • ◆Encryption — credentials at rest (AES-256), everything in transit (TLS 1.2/1.3).
  • ◆Data-subject rights — self-service export & confirmed erasure (GDPR Art. 15/17, DPDP).
  • ◆Auditability — actor-attributed trail of security-relevant events.
  • ◆Data isolation — single-tenant; client-controlled residency.
  • ◆Supply-chain assurance — automated dependency, SAST and secret scanning.
On the roadmap
  • ◆Enterprise SSO — SAML 2.0 / OIDC federation (MFA and data-subject rights are already live).
  • ◆Independent attestation — SOC 2 Type II / ISO 27001, once controls are seasoned.
  • ◆Penetration test — third-party assessment with a shareable letter.
  • ◆Secrets management — KMS / vault with rotation.