Security and data

The application, its background worker and its database run on Fly.io in Sydney, Australia. Documents you upload are held in Tigris object storage in the same region.

A few services the platform calls process data elsewhere: notification emails are delivered by Resend, and the optional liveness check on the attendance clock, if your employer turns it on, is processed by Amazon Web Services. The public website pages use Google Analytics to count visits, for visitors who are not signed in only; it is never loaded inside the platform, and is never sent platform data. Our privacy policy says which, and where.

Being confirmed · The hosting region above is read from the deployment configuration. The formal data residency statement Ask Your HR commits to, the location of the off-site backup bucket, and the complete sub-processor list (including the AI provider behind the optional assistant) are being confirmed for publication. Until then the list in the privacy policy is the one to rely on.

• In transit: Every connection to the platform is HTTPS. Plain HTTP is redirected, and browsers are told to use HTTPS only for the following year, on every subdomain.
• At rest, field by field: The fields that would cause harm if disclosed are encrypted with AES-256-GCM before they are written to the database: IRD numbers, tax codes, bank account numbers, home addresses, emergency contacts, pay rates and salary history, visa numbers, sick-leave reasons, disciplinary and investigation narratives, performance review responses, the face template for the attendance clock, two-factor secrets and payroll connection tokens. They are stored as ciphertext and cannot be read with a database query.
• At rest, the whole store: The database volume is encrypted by Fly.io, and the document bucket is encrypted at rest by Tigris. Those are the providers' controls rather than ours, and we state them as such.
• Backups: A copy of the database is taken every night and uploaded to a separate private bucket under its own credentials, with the field-level encryption above still in place inside it. Uploaded documents are copied to the same bucket, append-only, so a deletion in the live store cannot delete the copy. The restore procedure is written down and has been rehearsed.

• Roles and permissions: Four roles with least-privilege defaults, and a permission grid an administrator can adjust. Managers do not see IRD numbers, dates of birth, home addresses, bank details or pay. Every rule is enforced on the server, never only in the browser, and is covered by automated tests.
• Your organisation only: Every query the application makes on your behalf is confined to your organisation by a mandatory scoping layer, and the database enforces row-level security policies on the application's tenant connection as a second line. Cross-tenant access is blocked technically, not just forbidden by policy.
• Platform staff: Ask Your HR staff reach a customer's data only through an audited support path, and every export of a record is logged with who took it and when.

• Passwords: Hashed with argon2id. The platform never stores or emails a password in the clear, and password reset links are single-use and expire.
• Brute-force protection: After 10 failed attempts at one email address from one network address, that address is locked out of that account for 5 minutes. The lock is keyed on the address and the email together, so someone who knows your email cannot lock you out from elsewhere.
• Sessions: Sessions expire on their own and can be ended everywhere at once from your security settings. Changing your password ends your other sessions too.
• Two-factor authentication: Built in, using codes from an authenticator app with recovery codes as a fallback, and available to every account. It is not switched on for everybody: an employer has a setting to ask it of everyone in their own organisation, and Ask Your HR decides whether anyone on the platform is asked for a code at all. Where it is on, a device you trust can be remembered for a limited time so you are not asked on every sign-in.

Every change to an HR record is written to an audit log: who made it, what changed, what it was before, and when. The database itself refuses any update or deletion of an audit entry, including from the application’s own credentials, so the log cannot be tidied after the fact. Sign-ins, failed sign-ins, exports and erasures are logged the same way.

For almost all personal information in the platform, your employer is the agency under the Privacy Act 2020: they decide what is collected and why, and we process it on their behalf. Here is what the platform does to help both of you meet it.

• Access and correction (principles 6 and 7): Most of what the platform holds about you is visible in your own profile, and you can download the whole of your record as one spreadsheet. An administrator can produce the same export for any employee to answer a written access request. Each export is recorded in the audit log.
• Keeping it no longer than needed (principle 9): Once the retention periods below have passed, an administrator can erase a former employee's record: everything that identifies or describes the person is destroyed, and only the skeleton the law requires the employer to keep remains, under an anonymised identity. The erasure cannot run earlier.
• Biometrics: The attendance clock's face template, if you choose to enrol, is a set of numbers, never a photo. It is encrypted, destroyed when you leave, and destroyed earlier on request.
• What we never do: Sell personal information, use it to train AI models, move employee data through the billing system, or let platform staff read tenant data outside an audited support path.

The privacy policy is the full statement. Unresolved complaints can go to the Office of the Privacy Commissioner at privacy.org.nz.

• Wage, time, holiday and leave records: Kept for at least 6 years after employment ends, which is what the Employment Relations Act 2000 and the Holidays Act 2003 require of your employer.
• Notifiable health and safety events: Kept for at least 5 years from the date WorkSafe is notified, under the Health and Safety at Work Act 2015. Incident records are never hard-deleted.

These are floors, not schedules: the platform refuses to erase a record before the longer of them has passed, and nothing is deleted automatically when it does. For an Australian employment the platform applies the Fair Work Act’s longer record-keeping period instead. “Deleting” an employee archives the record and immediately destroys their face template and clock PIN.

The in-app assistant is off until Ask Your HR switches it on for the platform. When it is on, it is given the question you type, a guide to the platform’s features and the New Zealand compliance reference the platform itself runs on. It is not connected to your organisation’s records, and conversations are not stored in AskHR360. Questions are sent to the AI provider under its terms, so do not include sensitive details about a person in one.

Email support@askhr360.com. See also our privacy policy and terms of service.