- Data Storage
- Security
Your data is safe with us
When it comes to data security, there's no room for mistakes or half-measures.
Data Storage
We use Microsoft® Azure® servers, compliant with global and industry standards such as the General Data Protection Regulation (GDPR), ISO 27001, HIPAA, FedRAMP, SOC 1, and SOC 2.
What else do we offer besides a great team?
Our data centers are located within the European Economic Area (EEA). Personal data is processed in Poland, the Netherlands (MS Azure Data Center), and Ireland (MS Azure Data Center).
We encrypt data at the interface level using SSL TLS 1.2 when connecting to external systems.
Our databases are encrypted with TDE (AES 256) and Dynamic Data Masking.
Every user can view the scope of their processed data. During the agreement period, clients can export their data at any time. Once the agreement ends, we delete the data.
We use technical and network safeguards to prevent data interception. System security relies on logical authentication and authorization mechanisms.
To maintain high security, we use monitoring tools that detect and prevent malicious events, threats, and intrusion attempts.
GDPR Compliance
At HRnest, data security is our top priority. Our system includes built-in privacy tools like encryption, data minimization principles, and user data management.
We believe our platform is one of the best choices on the market for businesses that value data protection.
All our employees are trained in:
GDPR-compliant data processing and security principles.
Data protection laws and information security requirements.
Reporting and handling incidents, including rapid response procedures and corrective actions.
Securing access to mobile devices and protection against malware.
Safe remote work – best practices for Wi-Fi and VPN usage.
Using IT infrastructure, including hardware, for business tasks.
System Access and Configuration
- Only authorized individuals who have signed confidentiality agreements and follow our security procedures can process data in HRnest.
- Access is function-specific and occurs within secured VPN networks.
- Before partnering with any tech provider, we thoroughly vet them to ensure they meet our standards. We have procedures in place for managing data breaches and security incidents. Our approach is transparent – clients know exactly how we keep their data safe.
GDPR Compliance
- We appointed a Data Protection Officer and implemented policies required under GDPR, including a custom-developed personal data protection policy, a register of processing activities and categories, a documented risk assessment methodology based on ENISA guidelines, and periodic risk evaluations.
End-to-End Data Protection
Your data is safe at every step. We follow the highest security standards to ensure its confidentiality and integrity.
System Design
We apply privacy by design and privacy by default in development processes to ensure safe and controlled software updates.
All workstations have antivirus software with auto-updates, and we manage vulnerabilities through patch management.
We conduct regular penetration testing by external auditors, along with internal IT security audits.
We separate production from testing and development environments, so personal data isn’t used outside production.
Users working in HRnest don’t have direct access to the core business logic or database layers.
User roles and permissions are strictly defined and managed. Read, write, update, and delete actions are granted per user or role – nothing extra, nothing loose.
We regularly test our systems and apps for data security. We update infrastructure, operating systems, and apps to fix vulnerabilities. Every IT change considers its impact on security.
The infrastructure, operating systems, and applications used for processing personal data are continuously updated to address existing vulnerabilities. When implementing changes in IT systems, security requirements are taken into account, and the impact of those changes on existing safeguards is assessed.
Login Security
- Define password rules: minimum length, change frequency, and alerts.
- Enable external logins with Microsoft or Google accounts, and enforce login via those methods.
- Enforce two-factor authentication (2FA) for all users.
Backups and Disaster Recovery
- Full backups of client databases are created every 24 hours, with incremental backups every 5 minutes.
- The data recovery process is tested every two months to ensure reliability.
- Clients can export their data and create their own backups at any time, with all backups stored separately from the main server.
Learn more