Real controls. Honest posture.
HR systems hold some of the most sensitive information in a company. Here is what is in place today, and what is not yet.
Controls we run in production now.
Production data and files are hosted in AWS Mumbai (ap-south-1) on managed Postgres. Data is encrypted in transit with TLS and at rest.
Row-level security is enforced on every table, and new tables get it automatically. Cross-workspace access is tested by automated database tests on every change.
Payslips, letters and employee documents sit in private storage. Access goes through your workspace permissions, never through public links.
Owner, admin, HR, payroll, manager, employee and auditor roles. Privileged functions run on the server and check the caller's role and workspace.
Payroll runs, adjustments and corrections need approval by someone other than the person who prepared them.
Sensitive changes and approvals are recorded with who, when and what changed, so HR and auditors can review them.
Access designed around responsibility, not convenience.
- · Define access by employee, manager, HR, payroll and administrator role
- · Separate entity and module responsibilities where required
- · Review authentication and provisioning requirements during solution design
- · Apply approval controls to sensitive operating actions
- · Confirm plan-specific capabilities before implementation
Operational changes should remain understandable.
- · Keep important approvals and workflow events visible
- · Review access changes as part of your governance process
- · Preserve policy acknowledgement and version history where configured
- · Define retention requirements with your legal and security teams
- · Confirm export and reporting needs during implementation
For employee data in DocklyOne People you are the data fiduciary and we act as your processor under India's DPDP Act. Processing, retention and breach-notice terms are set out in your agreement.
We do not hold SOC 2 or ISO 27001 certification yet. We will say so plainly until we do, and share our control evidence during your security review.
Point-in-time recovery is being enabled before India payroll launches. Recovery objectives are confirmed in your agreement.
Define service expectations around your critical HR windows.
Payroll and employee lifecycle deadlines deserve clear operating procedures. Service levels and continuity commitments should be confirmed in the applicable agreement.
Live statusMumbaiConfigureDocumentConfirmAgreeDefine
Review your security requirements
Bring your security, privacy and continuity requirements to a focused solution review.