HRMZY holds some of the most sensitive data a business has — salaries, contracts, identity documents. Here is exactly how the platform protects it.
Optional TOTP-based 2FA with recovery codes on every account, so a stolen password alone is not enough to get in.
Granular roles and per-module permissions decide exactly who can see and change what — payroll data stays with payroll admins.
Every record is scoped to your company at the query layer. One customer can never read another customer's data — the isolation is enforced in code and covered by automated tests.
Sensitive uploads — payslips, contracts, passports, visas, employee documents — are stored outside the public web root and served only through permission-checked download routes.
File uploads are validated by extension and content type (executables and double-extension tricks are blocked), and user input is sanitized against script injection.
All traffic is encrypted in transit with HTTPS and HSTS; a strict Content-Security-Policy, frame protection and modern security headers guard every response.
Built-in data-subject tooling: consent tracking for leads, erasure and anonymization workflows, and data-deletion requests honoured on request.
Passwords are stored only as strong one-way hashes, and login endpoints are rate-limited to shut down brute-force attempts.
Administrators can schedule recurring database backups from the control panel, so a recovery point is always available.
Found a vulnerability? We want to hear about it before anyone else does. Report security issues to contact@hrmzy.com with "SECURITY" in the subject line and we will respond promptly. Please do not disclose an issue publicly before we have had a chance to address it.
Talk to us about your requirements — we're happy to walk through how HRMZY handles your data.