Security at PrimeHR

1Infrastructure & Hosting

PrimeHR is hosted entirely on secure cloud infrastructure in Mumbai, India. Our architecture is designed for resilience and isolation:

• Network isolation · each environment runs in a dedicated private network with strict security group rules
• Private subnets · databases not directly accessible from the public internet
• WAF · Web Application Firewall filters SQLi, XSS, and malicious traffic
• DDoS mitigation · Shield protection on all public endpoints
• CDN · static assets served via global content delivery network
• Load balancing · traffic distributed across multiple availability zones for high availability

2Data Encryption

At Rest

• All databases encrypted with AES-256 using cloud-managed key management
• Object storage (documents, payslips, attachments) uses server-side encryption
• Encryption keys rotated annually; access is logged

In Transit

• TLS 1.3 enforced on all client-server communication (TLS 1.2 minimum)
• HSTS with max-age of one year
• SSL/TLS certificate management with automatic renewal
• Internal service-to-service communication is also encrypted

Sensitive Fields

Aadhaar numbers, bank account details, and PAN are additionally encrypted at the application layer before storage, with field-level keys separate from database keys.

3Access Control & Authentication

• RBAC · granular permission sets: Super Admin, HR Manager, Finance Manager, Employee, and custom roles
• MFA · mandatory for all administrator accounts; available for all users
• SSO · SAML 2.0 and OAuth 2.0 (Google Workspace, Microsoft 365) for enterprise customers
• Session management · sessions expire after 8 hours of inactivity; refresh tokens rotated on each use
• Audit logs · all login events, data exports, and config changes logged with timestamp and IP
• IP allowlisting · enterprise customers can restrict access to approved IP ranges

4Backups & Disaster Recovery

• Daily backups · full database snapshots every 24 hours, retained for 30 days
• PITR · transaction logs enable recovery to any second within a 7-day window
• Multi-zone replication · automatic failover within 60 seconds
• RTO: < 4 hours · RPO: < 1 hour
• Disaster recovery drills conducted biannually

5Compliance & Certifications

PrimeHR is built to align with Indian regulations and international best practices:

6Application Security

• OWASP Top 10 · addressed in every development cycle and code review
• SAST · automated security scanning on every pull request
• Dependency scanning · third-party libraries scanned for known CVEs on every build
• Penetration testing · annually by a CERT-In empanelled independent firm
• CSRF protection · all state-changing endpoints require CSRF tokens
• Rate limiting · API endpoints rate-limited to prevent brute-force and enumeration attacks
• CSP headers · strict Content Security Policy to prevent XSS
• SQLi prevention · parameterised queries throughout; no raw SQL from user input

7People & Processes

• Security training · mandatory quarterly security awareness training for all engineers
• Background checks · conducted for all employees with production access
• Least privilege · production data access restricted to minimal group with MFA; reviewed monthly
• Change management · all production changes require peer review, automated testing, and staged rollouts
• Vendor management · all sub-processors undergo security review before onboarding

8Incident Response

PrimeHR maintains a documented Incident Response Plan with the following stages:

9Responsible Disclosure

We welcome security researchers who identify vulnerabilities. Please report responsibly · do not exploit or publicly disclose before we have addressed it.