Security2 min read
HR data security: what really protects your employees
An attendance and payroll database holds an institution’s most sensitive information: the identity, pay and biometrics of its employees. Here are the protections that matter, and why.
The security of HR software is not judged by its promises but by what happens the day something goes wrong: a stolen password, a lost computer, an employee correcting something they should not have. Here are the four protections we consider non-negotiable.
1. Encryption wherever data travels
All communications go over HTTPS (TLS 1.3), from the employee’s browser as well as from the biometric terminal. At rest, data is protected; biometric templates, for their part, are kept only encrypted, with a key held outside the database. Stealing the database alone therefore yields no usable fingerprint.
2. Authentication that withstands password theft
A password always leaks eventually. Two-factor authentication with a one-time code, compatible with Google Authenticator or Authy, closes that door: without the user’s phone, the password is not enough. Recovery codes avoid locking out a manager who loses their device.
3. Everyone gets their rights, nothing more
Four default roles, adjustable entity by entity: the Super Admin, the entity admin, the manager and the employee. A manager approves for their team but does not touch payroll; an employee sees only their own clock-ins and their own payslips. Least privilege limits what a compromised account can do.
4. A trace of every action
The audit log records logins, creations, sensitive changes and approvals, with their author and date. A clock-in correction never replaces the original: it is added alongside it. That is what makes the attendance sheet hold up during an inspection.
Security is also about hosting
Automatic backups, redundancy and a disaster recovery plan complete the setup. And because where data lives is as much a security question as a legal one, OPTimes can be hosted in DR Congo or on your own servers — see our article on digital sovereignty.
Does your IT department have specific questions? We answer security questionnaires and present the architecture during the demo. The summary is on our Security page.
Frequently asked questions
Are fingerprints stored in plain text?
No. Identification happens on the terminal, and the biometric templates kept by the platform are stored only encrypted, with a key held outside the database.
Do ports need to be opened on the institution’s network?
No. The terminals initiate the encrypted connection to the platform themselves; no inbound port needs to be opened.
