HRMZY holds some of the most sensitive data a business has — salaries, contracts, identity documents. Here is exactly how the platform protects it.
Optional TOTP-based 2FA with recovery codes on every account, so a stolen password alone is not enough to get in.
Granular roles and per-module permissions decide exactly who can see and change what — payroll data stays with payroll admins.
Every record is scoped to your company at the query layer. One customer can never read another customer's data — the isolation is enforced in code and covered by automated tests.
Sensitive uploads — payslips, contracts, passports, visas, employee documents — are stored outside the public web root and served only through permission-checked download routes.
File uploads are validated by extension and content type (executables and double-extension tricks are blocked), and user input is sanitized against script injection.
All traffic is encrypted in transit with HTTPS and HSTS (max-age two years, preloaded). Every response also carries a Content-Security-Policy, frame protection and the modern security headers.
Built-in data-subject tooling: consent tracking for leads, erasure and anonymization workflows, and data-deletion requests honoured on request.
Passwords are stored only as strong one-way hashes, and login endpoints are rate-limited to shut down brute-force attempts.
Administrators can schedule recurring database backups from the control panel, and download or restore an archive from there.
Found a vulnerability? We want to hear about it before anyone else does. Report security issues to contact@hrmzy.com with "SECURITY" in the subject line and we will respond promptly. Please do not disclose an issue publicly before we have had a chance to address it.
Talk to us about your requirements — we're happy to walk through how HRMZY handles your data.
We would like to use analytics cookies to understand how this site is used. They are not required to browse, and we set nothing else. See our Cookie Policy.