Security and trust, built into the work
HR data is personal and payroll is money. HR4ON protects both with controls inside every screen: who may see what, who may approve what, and a record of everything that happened.
Access: the right people, the right data
Roles
Built-in roles for employees, managers, HR, payroll makers and checkers, finance, leadership, auditors, asset custodians, case workers and administrators, plus roles you define.
Data scope
Every grant is scoped: self only, own team (following reporting changes), an organisation unit and those below it, one company, or all companies with approval.
Same scope everywhere
Scope is enforced in screens, reports and exports. Exports keep the screen’s masking and are recorded in the audit log.
Approved access
Sensitive and privileged roles take effect only after an access approver agrees. Temporary access can end on a set day.
Emergency access
Time-limited, with an accountable sponsor, and the access approvers are alerted.
Access reviews
Review sensitive grants, all-company scope, inactive users with access and incompatible role combinations. Revocations apply on completion.
Approvals: four eyes on what matters
Approval chains are configurable, but some rules are fixed.
- Nobody approves their own request, payroll run, payment batch or input.
- Whoever calculated or submitted a payroll run can never approve it, whatever their role.
- A change to the underlying data after approval cancels the approval.
- Escalation adds approvers; it never approves on anyone’s behalf.
- Statutory rule packs, workflow versions, letter templates and policies are published only after a second person signs off.
- Payments are marked paid only on bank evidence, and a batch cannot be sent twice.
Audit: a history you can verify
The audit log records every change and every sensitive read: who, when, from where and why, with the values before and after.
Records are sealed every few minutes into SHA-256 blocks, each chained to the one before. Verify Now recomputes the chain and reports the first block that does not match, so an edit, deletion or insertion cannot go unnoticed.
- Masked by default. Identity numbers, bank accounts and statutory numbers are masked; revealing one needs a reason and is recorded.
- Redacted history. Sensitive values appear as redacted in employee history.
- Confidential files. Every download of a confidential document is recorded.
- Read-only auditors. The auditor role sees across modules without being able to change anything, and its own activity is audited.
Privacy: tools for your obligations
HR4ON gives your privacy and HR teams the means to answer people and keep only what you should.
Privacy requests
Requests to see, correct or erase personal data, tracked to a due date. Employees can raise them from My privacy.
Consents
Optional uses of personal data, such as a photo in the directory or birthday wishes, are each chosen by the employee.
Data inventory
A register of the personal data held and how sensitive it is.
Retention
Retention policies with period, trigger and legal authority. Runs are previewed and approved before anything is removed.
Legal holds
Records under a legal hold are never removed, including helpdesk cases.
Privacy in analytics
Groups of fewer than five people are hidden in dashboards, and surveys hide groups below your minimum size.
Sign-in and sessions
- People join with a one-time invitation code and set their own password.
- Two-step verification with an authenticator app. You can withhold sensitive permissions from anyone who has not turned it on.
- Accounts lock after repeated wrong passwords, and sessions time out after inactivity.
- Users see where they are signed in and can end other sessions; administrators can sign a user out everywhere.
- Leavers’ accounts are disabled on their last day.
Attendance data, handled with care
- Location is read once, only at the moment of a punch, and only when your policy and the employee allow it. There is no tracking in between.
- Selfies are seen only by the employee, their manager and HR, and are deleted after the retention period you set.
- Biometric devices send only an identifier and a time. No fingerprints or face templates are stored.
- The installed phone app never keeps personal or payroll data in its offline cache.
Watching over the system
Administrators have a security centre and an operations view inside HR4ON.
- Security alerts, such as many failed sign-ins from one address, to acknowledge, escalate or dismiss.
- Incidents tracked from open to closed, with a flag when personal data may be involved and a notification assessment.
- Support access that is time-limited and approved.
- Password, lock-out and session policies in one place.
- Where HR4ON is hosted and where your data is kept is agreed with you as part of your deployment. Ask us.
See HR4ON with your own processes in mind
Tell us how many people you employ and what matters most. We will walk you through HR4ON on a laptop and a phone.