Security & Privacy
Learn how AttendUX protects your company data with industry-standard security measures.
Overview
AttendUX is built with security at its core. We implement multiple layers of protection to ensure your employee data, attendance records, and payroll information remain safe and private.
Our security architecture follows industry best practices including encrypted communications, strict access controls, data isolation between tenants, and regular automated backups.
Data Encryption
All data is encrypted both in transit and at rest:
| Layer | Technology | Purpose |
|---|---|---|
| In Transit | TLS 1.2 / HTTPS | All API calls and web traffic are encrypted between client and server. |
| At Rest | AES-256 | Database records and file storage are encrypted on disk. |
| Passwords | bcrypt (cost 12) | User passwords are hashed and salted — never stored in plain text. |
| API Keys | SHA-256 HMAC | API authentication tokens are cryptographically signed. |
Access Control
AttendUX uses Role-Based Access Control (RBAC) to ensure users only see and modify data they are authorized to access.
Admins can configure granular permissions for each role — from full admin access to read-only employee views. See the Permissions page for detailed configuration.
Data Isolation
Each company on AttendUX operates in a completely isolated data environment.
Company data is segmented at the database level. No company can access another company's employees, attendance, or payroll data — even if hosted on the same server.
Backup & Recovery
AttendUX maintains automated backups to protect against data loss:
| Backup Type | Frequency | Retention |
|---|---|---|
| Full Database Backup | Daily at 02:00 AM | 30 days |
| Incremental Backup | Every 6 hours | 7 days |
| Configuration Backup | On every settings change | 90 days |
Privacy Policy
AttendUX collects only the minimum data necessary to provide HR and attendance services. We do not sell or share your data with third parties.
Face recognition data is stored as encrypted mathematical vectors and cannot be reverse-engineered into photos. GPS location data is used only for geofence verification during check-in and is not tracked continuously.