Security
Security, and the limits of what we claim about it.
PaqadHR isolates every workspace as its own tenant, scopes every query to that tenant, and enforces role-based access on top. Sessions live in httpOnly cookies, HTML is served under a nonce-based content security policy, payout webhooks are signature-verified, and money-moving actions are audited. We do not hold SOC 2 or ISO 27001 certification today.
Last reviewed
Controls in the product
Tenant isolation
Every workspace is its own tenant. Reads and writes are scoped to the caller’s tenant at the query layer, and a resource lookup that does not belong to the tenant is treated as missing rather than forbidden, so the API does not leak the existence of another company’s records.
Role-based access
Owners, administrators, managers, and employees see different surfaces. Payroll, billing, and member management are restricted to owners and administrators; sensitive endpoints additionally enforce role guards at the controller.
Sessions in httpOnly cookies
Access tokens are stored in httpOnly, same-site cookies rather than localStorage, so a cross-site scripting bug cannot read them. State-changing requests require a CSRF token.
Content Security Policy
Every HTML response carries a nonce-based CSP with strict script sources. Inline scripts require the per-request nonce; framing is denied; object embedding is disabled.
Transport security
Traffic is served over TLS with HSTS (two years, includeSubDomains, preload), and the app sets clickjacking, MIME-sniffing, referrer, and permissions policies by default.
Payment and payout integrity
Payout webhooks require a valid provider signature. Payouts carry idempotency keys so a retry cannot pay twice, and a retry is blocked unless run-scoped funding has been verified server-to-server with the provider.
Audit logging
Administrative and money-moving actions are recorded with the acting member. Logs are written without secrets, tokens, or unnecessary personal data.
Rate limiting
Authentication, checkout, and payout endpoints are rate limited separately from ordinary reads, which blunts credential stuffing and accidental double-submits.
What we do not claim
Security pages are usually a list of badges. Here is the honest version, because a payroll buyer should be able to tell the difference between a control that exists and a certificate someone bought:
- No SOC 2 or ISO 27001 certification. If your procurement process requires either, ask us for the current status and timeline before you plan around it.
- No published uptime SLA on self-serve plans. Contractual availability terms are agreed in the order form, not implied by this page.
- No claim that we are a payment institution. Payouts and collections run through regulated payment partners; PaqadHR is the system of record around them.
Personal data
We process employee data on your instructions as a processor. What we collect, why, and how long we keep it is set out in the privacy policy; the terms that govern that processing are in the data processing agreement. Subprocessors are listed in the privacy policy.
Reporting a vulnerability
Email info@paqadhr.com with enough detail to reproduce the issue. Please do not test against another tenant’s data, run automated scanners against production, or disclose the issue publicly before we have had a chance to fix it.
Security questions
Does PaqadHR have SOC 2 or ISO 27001 certification?
Not today. PaqadHR is not certified to SOC 2 or ISO 27001, and this page will say so until it is. If your procurement process requires certification, email info@paqadhr.com and ask for the current status and timeline rather than assuming one.
Where is customer data stored?
On infrastructure operated by PaqadHR and its named subprocessors. The privacy policy lists those subprocessors and the processing each one performs, and the data processing agreement sets out the terms. We do not publish the underlying hosting topology as a security control, because it is not one.
Can one customer see another customer’s employees?
No. Every workspace is a separate tenant, every query is scoped to the caller’s tenant, and a resource that belongs to another tenant is treated as missing rather than forbidden. Access inside a workspace is then limited by role.
How are user sessions protected?
Access tokens are held in httpOnly, same-site cookies rather than localStorage, so injected scripts cannot read them. State-changing requests require a CSRF token, and pages are served under a nonce-based content security policy that blocks inline script injection.
Do your logs contain employee data?
No. Logs are written without secrets, tokens, and unnecessary personal data. Audit records exist for administrative and money-moving actions so that a customer can answer who did what, without turning the audit trail into a second copy of the payroll.