Security
How we look after your employees' data
An HR system holds salaries, PAN, bank accounts and ID documents. Here is how ClanChief protects them, first in plain words and then in detail for your IT team.
Each company's data stays separate
Brands in the same group never see each other's people, salaries or files. The database itself enforces this, not just the screens.
PAN and bank details are encrypted
The most sensitive fields are stored encrypted, so they are unreadable even to someone who gets a copy of the database.
2-step login for admins
Anyone who can see salaries or change settings must confirm their login with an authenticator app. Company single sign-on is supported too.
Every change is recorded
Who changed what, and when, is kept in a log that cannot be quietly edited or deleted.
For your IT and security team
- Tenant isolation
- PostgreSQL row-level security per company; the application connects with a least-privilege role that cannot bypass it.
- Encryption
- TLS in transit. PAN, UAN, ESI and bank account numbers encrypted at field level with AES-256-GCM. Files in per-company folders in encrypted S3 storage.
- Sign-in
- Email and password with TOTP 2-step verification (mandatory for admin roles), or company SSO over OpenID Connect. Short-lived access tokens with rotating refresh tokens.
- Audit trail
- Append-only, hash-chained audit log: each entry is linked to the one before it, so edits or deletions are detectable.
- Application hardening
- Rate limiting, strict Content Security Policy, role- and brand-based access checks on every API call.
- Attendance integrity
- Selfie punch, geofences, optional device binding and office network restriction, chosen by the HR head.
DPDP Act 2023
The Digital Personal Data Protection Act gives employees rights over their data. These tools are built in.
- Employees can download their own data
- Correction and deletion requests with tracking
- Breach register for HR and IT
ISO 27001 and SOC 2
ClanChief is not certified yet. It includes a compliance centre that tracks the controls these standards ask for and collects evidence automatically, which helps you and us prepare for an audit.
- ISO 27001 and SOC 2 controls mapped in the product
- Automated checks that collect evidence
- Quarterly access reviews
- Policy acknowledgements by employees
- Auditor pack export
Need a security questionnaire filled in?
Send it to us. We answer vendor security questionnaires as part of every evaluation.