How we protect your HR data
Payroll, bank details and employee records are some of the most sensitive data a company holds. Here is how we keep them safe.
Security overview
HR data is among the most sensitive data your organisation manages: payroll figures, bank details, statutory identifiers, performance records and employment history. A breach does not just affect your company; it affects every employee on the platform.
This page says plainly what we do today. If something isn't listed here, don't assume we do it. Ask us at [email protected].
i-Swipe HR Suite is built to help you meet the Nigeria Data Protection Act 2023 (NDPA) and the NDPC's General Application and Implementation Directive 2025 (GAID). See our privacy policy and the trust page for sub-processors and our data processing agreement.
Application security
Every request is checked against the signed-in company. One company can never open another company's records.
CVs, staff documents and photos are stored outside the public web folder and served only to people allowed to see them.
Every form carries an anti-forgery token. Session cookies are HttpOnly and SameSite.
Pages cannot be framed by other sites (clickjacking), browsers may not guess file types, and HTTPS is enforced with HSTS.
Sign-in, password reset, one-time codes, job applications and public forms are rate-limited against guessing and floods.
Nightly database backups, kept on a rotation (daily for 14 days, weekly for 8 weeks, monthly for a year), with a monthly restore drill.
Encryption and secrets
| Data | Protection |
|---|---|
| Data in transit | HTTPS (TLS) for the website, app and API, with HSTS |
| Passwords | bcrypt (cost 12). Never stored in plain text or a reversible form. |
| Two-step sign-in secrets | AES-256-GCM |
| API keys | Only a SHA-256 hash is stored. The key is shown once, when it is created. |
| Bank account numbers, NIN, RSA PIN and TIN | Encrypted in the database (AES-256-GCM) and in backups. Masked on screen; only HR admins and finance can see pay and bank details, and every reveal is logged. |
| Payslip PDFs | Optional password, chosen by your employer (AES-128) |
| Clock-ins | Checked for VPNs, data-centre networks, fake-location apps and borrowed phones; the evidence is kept one year |
The database and backups are protected by the hosting server's access controls. Other personal data in the database is not encrypted field by field; the items listed above are.
Access controls
Inside your organisation
- Roles decide who sees what: HR, finance, line managers, executives and staff
- Pay and bank details only for HR admins and finance
- Approval workflows, and four-eyes sign-off before payroll is locked
- Self-service limited to each person's own records
- An audit trail of changes, with time, user and IP address
- Two-step sign-in, which your company can make compulsory, plus single sign-on with Google, Microsoft or SAML
Inside i-Swipe
- Platform admins have separate accounts, with roles and two-step sign-in
- Every platform admin action is written to a platform audit log
- Only super admins and support staff can open a customer's account to help, and each session is logged from start to end
Monitoring
Background jobs, email delivery and backups are checked every 15 minutes, and live status is shown at /status.
Successful and failed sign-ins are recorded and kept for one year.
Changes are recorded with who made them and when, and kept for two years.
Errors are tracked without storing passwords or tokens.
Compliance
The app helps you meet your own obligations as an employer and data controller:
For audit questions, contact [email protected].
Incident response
If a security incident affects personal data:
- We contain it and find out which companies and people are affected
- We tell each affected customer without undue delay, so they can meet the NDPA's 72-hour deadline for notifying the NDPC
- Where we are the controller, we notify the NDPC within 72 hours ourselves
- We share what happened, the root cause and what we changed
Security testing
Every release runs an automated test suite that includes checks on company separation. Code changes are reviewed, and security findings are fixed before release. We have not yet had an independent penetration test. When we do, Enterprise customers can ask for the summary.
Report a vulnerability
We welcome responsible disclosure from security researchers. If you have found a vulnerability in i-Swipe HR Suite, we want to hear from you.
- Email your finding to [email protected] with a clear description and steps to reproduce
- Do not access, change or delete any customer data during your research
- Do not run denial-of-service tests or social-engineer our team or customers
- Give us reasonable time to investigate and fix the issue before publishing
- We acknowledge reports within 2 working days and give a timeline for valid findings
If you think you have found a critical vulnerability that puts customer data at immediate risk, put CRITICAL in the subject line so it is read first.
Security: [email protected] · Compliance: [email protected]
© 2026 i-Swipe Technologies Limited. This page is updated when our security measures change.