Passwords done properly
Hashed with argon2id at 64 MiB of memory. At least 12 characters, checked against a list of common and breached passwords, and no forced rotation. Five failed attempts lock the account for a while.
Security & trust
Security that lives in the architecture, not in a policy document
An HR system holds the most sensitive records a business keeps. Here is exactly how PeoplePilotOS protects them: what is isolated, what is encrypted, who can see what, and what gets written down when they do.
- A database per organization
- AES-256-GCM field encryption
- Append-only audit trail
- MFA with step-up
01 · Tenant isolation
Every organization in its own database
Many HR platforms keep every customer in one shared set of tables and rely on a filter in each query to keep them apart. PeoplePilotOS does not. When your organization is set up, it gets its own PostgreSQL database and its own login role, and that role can reach your database and nothing else. There is no table anywhere holding two customers' rows, so no query, whether a bug or an attack, can return your data next to someone else's.
- The organization comes from the signature. Which organization a request belongs to is read only from the signed sign-in token, never from anything the caller sends.
- The address is checked against it. A token for one organization replayed on another organization's address is refused before any data is read.
- Tested against real databases. The integration suite provisions real, separate organization databases, seeds each with a unique marker and checks it never appears anywhere else.
- A shared directory that knows almost nothing. To route your sign-in, the platform's directory holds an email address and which organization it belongs to. No names, no profiles, no passwords.
02 · Identity and access
The right person, with the right access, confirmed again when it matters
Multi-factor authentication
Authenticator-app codes (TOTP) with one-time backup codes. Anyone holding a sensitive permission must enrol, and an administrator can require it for everyone.
Single sign-on
Sign in through your own identity provider over OpenID Connect. The provider's client secret is stored encrypted.
Roles, permissions and scopes
Fine-grained permissions grouped into roles, each limited to a scope: self, team, department, location, legal entity, business unit, cost centre or the whole organization. An explicit deny always wins.
Short-lived sessions
Access tokens are EdDSA-signed and last 15 minutes. Refresh tokens are single-use and stored only as a hash; replaying an old one revokes the whole session. Sign-out and revocation take effect on the next request.
Revoked means revoked
Permissions are not baked into the token. They are worked out on every request, so taking a role away from someone takes effect immediately, not when their token expires.
Step-up: a fresh code before the sensitive things
Every permission is graded. Viewing compensation, opening a restricted case and destructive actions such as changing roles all need an MFA verification from the last 15 minutes. If yours is older, PeoplePilotOS asks for a code before going ahead, even mid-session.
- Compensation: permission, step-up and an access-log row
- Restricted: a per-case allowlist, step-up and an access-log row
- Destructive: step-up and a mandatory reason
03 · Data protection
Encrypted again, inside your own database
Disk encryption protects a stolen disk. It does not protect a stolen backup or a database dump, which read as plain text. So the fields that matter most are encrypted by the application itself with AES-256-GCM before they are stored. GCM is authenticated: a tampered value fails to decrypt instead of quietly changing.
What is encrypted at field level
- Government identifiersAadhaar, PAN and passport numbers, with keyed look-up indexes so a search never needs the plain value
- Bank detailsBank account numbers; screens and audit records show only the last four digits
- Employee relationsGrievance and investigation descriptions, findings, minutes, recommendations and outcomes
- Filed statutory statementsPF ECR, ESI returns, PT challans and Form 24Q, decrypted only when an authorized user opens the filing
- SecretsMFA seeds, single sign-on client secrets, webhook and chat-integration signing secrets
Personal data masked unless you're allowed to see it
A report column marked as personal data is replaced with [redacted] for anyone without the
permission to read it. The on-screen run and the export use the same code, so an export can't reveal more than
the screen. A masked export is logged as such.
The AI assistant strips email addresses, PAN, IFSC codes, Aadhaar-shaped and other long numbers, and phone numbers out of what is sent before any external model call, and puts them back in the answer on our side.
04 · Audit and accountability
If it can't be recorded, it doesn't happen
Every change in your organization writes an audit row (who, what, before and after, the reason, the IP address and a request id) inside the same database transaction as the change. If that row cannot be written, the whole change rolls back. An unattributed change does not exist.
-
Bank account changed · Arjun M.
-
Role granted · Payroll Manager → Rohan K.
-
Compensation viewed · Ananya R.
-
Report exported · Headcount by location
Five trails, none of them editable
- Audit log: every change, with before and after
- Access log: who viewed sensitive personal and pay data
- Sign-in history: every attempt, including failures
- Export log: every export, and whether it carried personal data
- File access log: every document view and download
These tables are append-only at the database level: a trigger rejects any update or delete, so even someone holding the application's own credential cannot rewrite history.
Our support team works on your terms
Support access to your organization is managed under Settings → Support access. You can grant access, approve or deny our requests and revoke a grant at any time, see how each grant was used, and see every emergency session ever opened against your organization. Each of those actions is written to your own audit trail.
05 · Backups and recovery
A backup nobody has restored is a hypothesis
Because each organization is its own database, it is backed up and restored on its own. A restore touches your database and nobody else's. We don't just take backups; we restore them and check the result.
- DumpA full archive of a randomly chosen organization
- RestoreInto a fresh, isolated database
- CountEvery row of every table, and the schema version
- VerifiedOnly when the copy matches the source
- Why counts, not exit codes. A restore tool can report success after creating every table and none of the rows. Counting every row is the only check that can't pass on an empty copy, and a source with zero tables is a failure, not a pass.
- Random, so the whole fleet is covered. Checking the same three organizations every time only proves those three. The sample moves, so a broken backup anywhere gets found.
- Restore drills, timed by phase. A drill restores one organization end to end and times each step separately, so we know how long a recovery takes rather than guessing.
06 · Application security
Guard rails the code can't forget
No route without a permission
At startup the API checks that every route declares the permission it needs. A route that forgets will stop the server from starting at all, so it can never reach production.
Strict input validation
Request bodies, queries and parameters are checked against schemas, and unknown fields are rejected rather than silently dropped. Database access goes through parameterised queries.
Hardened by default
Standard security headers on every response. The refresh cookie is httpOnly and SameSite=Strict. Error responses carry a request id, never stack traces, and logs redact passwords, tokens and identifiers.
Rate limits on the doors attackers knock on
Account lockout stops guessing against one account. Rate limits stop an attacker spreading attempts across thousands.
| Endpoint | Limit |
|---|---|
| Sign-in | 10 per minute per IP address |
| Password reset | 3 per hour |
| MFA verification | 10 per 5 minutes |
| Single sign-on | 30 per minute |
| Failed passwords | 5, then the account locks |
Tested against real databases
The API's integration tests run against real PostgreSQL, provisioning disposable organizations with their own databases, because a mock would happily agree that two databases can't see each other while proving nothing.
198
API integration test files
Accessibility is held to the same standard: the product's colour tokens are checked against WCAG 2.1 AA contrast ratios in both light and dark themes.
07 · Privacy
Your data, your control
Consent, purpose by purpose
Following the consent model of India's DPDP Act 2023, optional processing such as background verification, biometric attendance or health data for benefits is asked for one purpose at a time, with versioned wording, and can be withdrawn.
Employees see and correct their own data
Self-service shows people their own record. Changes to controlled fields like a bank account go through a change request that is approved and audited.
AI that doesn't take your records with it
Personal identifiers are replaced with placeholders before any external model call and restored only in the reply you read.
Least data, everywhere
Personal data about your people stays in your organization's database. The shared sign-in directory keeps only an email address and which organization it belongs to.
Report a vulnerability
Found something? We want to hear about it. Email us with the steps to reproduce, what you believe the impact is, and how we can reach you. Please don't access, change or keep data that isn't yours while testing, and give us a chance to fix the issue before telling anyone else.
Ready when you are
Give your people an HR experience they'll actually enjoy.
See PeoplePilotOS with your own policies, payroll rules and org structure, in a 30-minute walkthrough.