Security
How we protect HR data
HR data includes salaries, absences and personal details. Remic is designed so that you and your clients can see exactly what is stored, why, and who accessed it.
In place today
In place-
Encryption per connection
HR system credentials are encrypted with AES-256-GCM using a separate data key for every connection (envelope encryption). The design is ready for a managed key service in production.
-
Data minimisation
Your client consents per data category. Data outside the granted scopes is removed before it is stored and filtered again when it is read. Free-text absence notes and reasons are never stored.
-
Consent records
Every connection keeps an append-only record of who granted access, to which scopes and when.
-
Audit log
Logins, API keys, connections, syncs, webhooks, settings and team changes are logged with actor, time and IP. Logs never contain secrets or employee data.
-
Signed webhooks without personal data
Webhooks are signed with HMAC-SHA256 and carry only IDs and field names. Webhook URLs to private networks and cloud metadata addresses are blocked.
-
Credentials stay with us
Clients enter credentials in our hosted connect flow. They never pass through your systems and no endpoint ever returns them.
-
Access control and rate limits
Team roles (Owner, Admin, Developer, Viewer), API keys stored as hashes, and rate limits on every public endpoint, login and connect session.
-
Client access portal
Your client's HR admin signs in with a one-time email link and sees which apps can access their HR data and how it was used. Revoking takes one click: credentials and synced copies are deleted immediately.
-
Request logs
Every call we make to an HR system is logged with method, path, status and duration, so you can see what happened, without bodies, headers or query values.
Planned
Planned-
EU production hosting
Production environments for real client data will run in the EU. We will publish the provider and sub-processors before onboarding real data.
-
Managed key service
Master keys in a managed key service (KMS) instead of an environment secret.
-
SOC 2 and ISO 27001
We intend to start SOC 2 Type 1 before our first enterprise customers. We do not hold any certification today.
Found a security issue? Email hello@remic.dev .