How Ploy HR protects your data.

Ploy HR is served over HTTPS, and in production every response carries an HTTP Strict Transport Security header (max-age 15552000 seconds, 180 days, including subdomains) so browsers refuse to downgrade to plain HTTP.

Pages are sent with a Content Security Policy that limits where content can load from (no plug-in objects, same-origin framing and forms), plus X-Content-Type-Options, X-Frame-Options, a no-referrer policy and same-origin opener and resource policies. Camera, microphone, payment and USB are switched off, and location is limited to this site for clock-in.

Passwords are hashed by Better Auth (scrypt) and never stored in readable form. They must be at least 10 characters, a verification email is sent at sign-up, and every other session is signed out when a password is reset.

Any account can turn on two-factor sign-in with an authenticator app and recovery codes. A fresh code is required on every new device, enrolling signs out older sessions, and five wrong codes lock the account for 15 minutes.

Requests that change data from a signed-in browser must carry a CSRF token. The API is rate limited, with tighter limits on invitation links, which are the only credential linking a person to a company record, and request sizes are capped.

Every account has a role (candidate, corporate, training centre or admin), and each role sees only its own screens and API routes. Inside a company, team members get access module by module. Company data is scoped to the company that owns it, and automated tests check that one company cannot read another's.

Significant HR actions across modules are written to an append-only audit log that records who did what to which record, with before and after snapshots where relevant. The code has no way to edit or delete an entry.

Every production release takes a database dump before migrations run, and a release that does not come up healthy is rolled back automatically.