Security
GI-JUN handles the most sensitive HR data: payroll, national ID numbers, bank accounts. Below are the protections actually in place today — nothing aspirational.
Data isolation
- Every table has company-scoped row-level security, so data from another company cannot even be queried.
- Sensitive tables (payroll, recruiting, health checkups, approvals) revoke client access entirely; only the server API touches them.
- Attachments live in a private bucket with per-path policies (owner, approvers, managers) and an allow-list of file types.
- Support-mode access by our operators is read-only, blocked from writing at the database level and fully logged.
Encryption
- Personal data such as national ID, bank account, wages and contact details is encrypted with an application key and shown masked.
- Decryption is possible only through the server API for people with the specific permission, and every access is logged.
- All traffic is TLS only (HSTS preload); database and backups are encrypted at rest.
Authentication
- Two-factor authentication (authenticator app) is supported and can be enforced per company for admins or everyone, with backup codes for recovery.
- Logins are protected by per-network and per-account rate limits, lockouts, bot checks (Turnstile) and rejection of breached passwords.
- New-device logins, password changes and two-factor changes are notified by email.
- You can review active sessions and sign out every other device. Password reset links work once and expire in an hour.
Access control
- Roles (owner, manager, member) plus fine-grained permission groups separate access to HR, payroll and contract data. Managers see only their organisation scope.
- Viewing payroll or national IDs requires a dedicated permission beyond the role, and nobody can edit their own HR record.
- Settings changes, permission changes, leave adjustments, logins, operator access and messenger exports are available as an audit log for 92 days with CSV export.
Monitoring & availability
- Server and client errors alert the operations team immediately; uptime is checked every 5 minutes and published on a status page.
- Login failure trends and credential-stuffing signatures (one IP trying many accounts) are watched continuously and IPs can be blocked.
- Company data can be exported in full (CSV) at any time and is permanently deleted 30 days after a deletion request.
Development security
- Every deploy passes type checks, linting, unit tests and 70+ end-to-end suites against the live environment, including permission and PII guards.
- Dependencies are updated automatically (Dependabot), audited for vulnerabilities and pinned with lockfile integrity hashes. Builds never receive the database admin key.
- Nonce-based CSP, clickjacking and MIME-sniffing protection, SSRF blocking and rate limiting are on by default.
- Regular full audits (permissions, isolation, correctness, operations, supply chain) are performed and recorded.
Data location & processing
- Database and file storage run on Supabase (AWS); the application runs on Vercel. Sub-processors are listed in the privacy policy.
- AI features never receive encrypted personal data in prompts, and usage is quota-limited and metered.
- Companies set their own messenger retention; notifications and logs are purged after fixed retention periods.
