Security

What we built, in the words we would use to a technical reviewer. Where something is not yet in place, this page says so.

Isolation between employers

Every tenant table in our PostgreSQL database has row-level security switched on and forced; the application connects with a role that cannot bypass it and does not own the tables.
The tenant is set per transaction, never per connection, so a pooled connection that served one employer cannot leak rows to the next.
A request that names another employer's record — by id, by count, by file link — gets the same answer as for a record that does not exist.
Background work (auto-close, reminders, scans) discovers what to do through narrow database functions that return ids and deadlines only, then re-enters the tenant's context before touching anything.

Email verification before a workspace exists; passwords of at least 12 characters; rate limits on sign-in and reset; responses that never reveal whether an address is registered.
Two-factor authentication with an authenticator app. Changes that affect the whole organisation — publishing a policy, granting support access, finalising a month, downloading an export — require the factor to be proved again in the current session.
Google sign-in never links to an existing account by email alone; linking is explicit, by the signed-in owner, after step-up. We store no Google tokens.
Roles are per organisation. Being someone's manager grants exactly the approvals that follow from that reporting line.

Timestamps come from our server, never from the device.
The office-network requirement is decided from the connecting address as our edge sees it; forwarded headers from a browser are ignored.
An administrative closure is recorded as what it is. It carries the deadline and the time it was processed; it never becomes a checkout.

Attachments are limited to PDF, JPEG and PNG by content, 5 MB each, stored under generated names outside any web root, quarantined until a malware scan (ClamAV) says clean, and served only through an authorised download that is re-checked against current roles every time.
Medical evidence is readable by its subject and HR reviewers only; it is never linked from a calendar or a report.

Attendance events are append-only; corrections supersede rather than overwrite. Leave is a ledger: credits, debits, reservations and reversals, each traceable.
A finalised month is a numbered snapshot with a content hash; its CSV and PDF are the persisted files of that version. Later corrections create a new version.
Decisions, policy changes, exports, downloads and support access are audited with actor, time and a redacted summary. Application roles cannot update or delete audit rows.

TLS everywhere with HSTS; the application listens on the loopback interface only, behind our edge server.
A verified database checkpoint is taken before every release, and restores are rehearsed. Off-host copies are on the roadmap; until they exist, this page says so rather than implying otherwise.
Retention is a setting per class of record (IP evidence, exports, audit), with a legal hold that stops every automatic removal. Deletion happens after a 30-day grace period and is recorded so that a restored copy is deleted again.

If you believe you have found a vulnerability, write to contact@inoroff.com with “Security” in the subject. We will acknowledge within two working days, keep you informed, and credit you if you wish. Please do not test against other customers' data.