How we protect your company's data
The controls below are implemented in the product today and can be demonstrated — no promises, and no certifications we do not hold.
A separate database per company
Each company's data lives in its own database, and the company is determined by its address, never by the content of a request.
Encrypted connection
The system and all of its interfaces are served over HTTPS.
Role-based permissions
Roles and permissions decide what each user can see and change, checked on the server on every request.
Audit trail
Sensitive changes are recorded with the acting user, the time, and the value before and after.
Protected sessions
A user's identity comes from their server-side session, and changing a password signs them out of every other device.
Device keys encrypted
A biometric device's communication key is stored encrypted and never sent back to the browser after it is saved.
Outbound-only attendance agent
The biometric agent starts every connection, so your network is never opened to the internet. It is activated with a one-time code, and can be revoked or have its credential renewed at any time.
Protected public forms
Website forms are protected against forged requests and rate-limited, and their data is used only to answer the enquiry.
We do not currently hold external certifications or compliance attestations, and we do not claim what we have not obtained.
Email our customer service address and we will follow up. support@saudhr.net
Ready to see SaudHR?
Request a demo and we will show you how the system works for your company.