Security
What data HRjects stores, how sign-in and access control work, which service providers process data, and what we do not have yet.
This page describes how HRjects handles your data today. It also lists, plainly, what we do not have yet. If you need something that is not covered here, email security@hrjects.com.
What HRjects stores
HRjects stores project information only: plans, tasks, process steps, checklists and issue descriptions.
It is not designed to hold employee records, pay data or personal details about staff, and we ask customers not to enter them. Parallel payroll runs record a variance percentage only.
The personal data we do hold is limited to:
- each user's email address,
- their name, if they give one, and
- their activity in projects.
Sign-in
- People sign in with a one-time link sent to their email address. Sign-in with Google and Microsoft is planned.
- No passwords are stored.
- Sign-in links are single-use and expire after 20 minutes. Only a one-way hash of each link is stored.
- Sign-in is protected by the person's own email account, including any two-step verification their company requires there.
Access control
- Every request is checked against the person's role in that workspace.
- One customer's data is not reachable from another's account. This is covered by automated tests.
- There are four roles: Owner, Editor, Contributor and Guest. A Guest can see one project only. See roles.
In transit and in the browser
- All traffic uses HTTPS.
- Session cookies are HTTP-only and secure.
Activity log
An activity log records changes in each project: who changed what and when.
Your control over your data
- Owners can export all of a workspace's data.
- Owners can delete the workspace.
- Users can delete their own accounts.
- Removed projects are erased after 30 days.
The steps are in this help article.
How we use customer data
We do not sell customer data or use it for advertising.
Service providers
These providers process data on our behalf:
| Provider | Purpose |
|---|---|
| Replit | Application hosting and database |
| Resend | Sending sign-in and invitation emails, and receiving email sent to hrjects.com addresses |
| Google (Gmail) | The mailbox where we read and answer messages you email to us |
When sign-in with Google and Microsoft is switched on, they will be added to this list. They would receive data only when a person chooses to sign in with them.
What we do not have yet
HRjects is a new product in preview. We do not have:
- SOC 2 or ISO 27001 certification,
- an independent penetration test,
- company single sign-on (SAML),
- a choice of data region, or
- an uptime guarantee.
Encryption at rest and backups depend on our hosting provider. Details are available on request.
If your company requires any of these before it can use a tool, HRjects is not ready for you yet. We would still like to know which ones matter to you.
Privacy rights and agreements
People can ask to access, correct, delete or export the personal data we hold about them by emailing privacy@hrjects.com. The Privacy Policy explains this in full. A data processing agreement is available on request.
Reporting a security problem
If you think you have found a security problem in HRjects, email security@hrjects.com with what you found and how to reproduce it.