{"id":155,"date":"2022-10-07T09:38:42","date_gmt":"2022-10-07T08:38:42","guid":{"rendered":"https:\/\/sense.hr\/blog\/?p=155"},"modified":"2025-09-27T08:01:37","modified_gmt":"2025-09-27T07:01:37","slug":"hey-hr-wheres-my-data","status":"publish","type":"post","link":"https:\/\/senseworkplace.com\/blog\/hey-hr-wheres-my-data\/","title":{"rendered":"Hey! HR! Where\u2019s my data?\u00a0"},"content":{"rendered":"\n

\u2026 and who\u2019s looking after it? <\/p>\n\n\n\n

What if one of your stakeholders asked you that question?  <\/p>\n\n\n\n

Could you answer them with any authority?  <\/p>\n\n\n\n

Or would you have to point them to your third-party HR software FAQs page, where they might find a list of certification numbers and some vague references to a fourth party Cloud service? Or, worse, would you start doing the \u2018lost stapler\u2019 dance\u2014shuffling paperwork, opening draws\u2014while mumbling something about the Cloud? Erm\u2026 what\u2026 sorry\u2026 HR can\u2019t come to phone right now.   <\/p>\n\n\n\n

Well, we don\u2019t want that for you. We want our community of HR professionals to have all the answers. So, pull up a pew and put your feet up\u2014you\u2019re in the SenseHR safe space now\u2014so safe that you can throw an asteroid at it. And no, we\u2019re not joking\u2014we never joke about data storage and security.   <\/p>\n\n\n\n

Certification <\/h2>\n\n\n\n

ISO\/IEC 27001<\/strong> <\/p>\n\n\n\n

This one\u2019s nothing new but it\u2019s important. ISO\/IEC 27001 certification shows real commitment to international security standards and best practices from both the HR software provider (us) and the Cloud provider (Azure). Each party puts in hundreds of work hours, training, and resources to produce a compliant Information Security Management System (ISMS) and pass a rigorous, multi-stage audit process, which is reviewed annually.  <\/p>\n\n\n\n

Any HR software provider worth their security claims, should be able to prove it with ISO 27001 certification. <\/p>\n\n\n\n

ISO\/IEC 27701<\/strong> <\/p>\n\n\n\n

While ISO\/IEC 27001 is stamped across the pages of every HR software website, you\u2019re less likely to find providers with ISO\/IEC 27701 certification. This international standard aims to bridge the gap between information security and data protection and privacy by providing a framework for organisations to protect Personally Identifiable Information (PII). Like ISO\/IEC 27001, it requires a Privacy Information Management System (PIMS) and it\u2019s an ongoing process, which ensures adherence to DPA18<\/a> and continual investment in keeping your information secure and data private.  <\/p>\n\n\n\n

What\u2019s more, unlike most other providers, we never access your data without your explicit permission. Even then, all access to your data is logged and the logs are viewable by your administrators. <\/p>\n\n\n\n

Microsoft Azure<\/strong> <\/h2>\n\n\n\n

Our systems are built using Microsoft Azure. Now, that doesn\u2019t mean that we\u2019ve outsourced our security responsibilities to Microsoft\u2014far from it\u2014and more on that later.  <\/p>\n\n\n\n

But listen, Microsoft have spent more than $1 billion USD in security\u202fR&D and 3,500 cyber security experts. Which means that SenseHR and each one of our customers are getting more than $1 billion USD of security R&D, as well as the security expertise of 3,500 of the best and brightest injected into our systems, and that\u2019s before we\u2019ve even started.  <\/p>\n\n\n\n

Essentially, we\u2019re standing on the shoulders of giants and then reaching that little bit higher.  <\/p>\n\n\n\n

And we\u2019re in good company. Government funded agencies from here to Australia<\/a>, as well as leaders in the automotive industry<\/a>, consumer goods<\/a>, pharmaceuticals<\/a>, manufacturing, healthcare, and even Microsoft themselves are using Azure.\u00a0\u00a0\u00a0\u00a0\u00a0<\/p>\n\n\n\n

Shared security responsibilities<\/strong> <\/h2>\n\n\n\n

According to the cloud security shared responsibility model, the cloud provider (Microsoft Azure), the data processor (us), and the data controller (you) are jointly responsible for data security at different stages. So, there\u2019s no question of us outsourcing security responsibility. <\/p>\n\n\n\n

Instead, your people data essentially has 3 babysitters.  <\/p>\n\n\n\n

For example, your organisation and HR department are responsible for devices that you use, accounts and access permissions, and the data that you enter\u2014and we\u2019ll do all we can to help you with that. MS Azure is responsible for physical security at their data centres, and their physical networks and network controls, applications, and infrastructure. While SenseHR are responsible for leveraging the security tools and services offered by Azure, our own systems, and the cream-of-the-cyber-security crop.  <\/p>\n\n\n\n

And boy have we leveraged a system to shout about.  <\/p>\n\n\n\n

Encryption in transit and at rest <\/strong><\/h2>\n\n\n\n

We store your data at rest\u2014that\u2019s data that isn\u2019t in transit between your systems and the Azure databases\u2013using AES-256 encryption. That\u2019s the absolute gold standard in data encryption\u2014it was developed to fulfil the security needs of the US government after all. To cut to the chase, a hacker would need 2256\u202f<\/sup>different combinations just to ensure the right combination was included. For reference, that\u2019s more combinations than the number of atoms in the observable universe. It would take billions of years to brute force using current computing technology. Still not convinced that 2256<\/sup> is a big number? Well the full number is 115, 792, 089, 237, 316, 195, 423, 570, 985, 008, 687, 907, 853, 269, 984, 665, 640, 564, 039, 457, 584, 007, 913, 129, 639, 936. Need more convincing? Written out, that number is one hundred fifteen quattuorvigintillion, seven hundred ninety-two trevigintillion, eighty-nine duovigintillion, two hundred thirty-seven unvigintillion, three hundred sixteen vigintillion, one hundred ninety-five novemdecillion, four hundred twenty-three octodecillion, five hundred seventy septendecillion, nine hundred eighty-five sexdecillion, eight quindecillion, six hundred eighty-seven quattuordecillion, nine hundred seven tredecillion, eight hundred fifty-three duodecillion, two hundred sixty-nine undecillion, nine hundred eighty-four decillion, six hundred sixty-five nonillion, six hundred forty octillion, five hundred sixty-four septillion, thirty-nine sextillion, four hundred fifty-seven quintillion, five hundred eighty-four quadrillion, seven trillion, nine hundred thirteen billion, one hundred twenty-nine million, six hundred thirty-nine thousand, nine hundred thirty-six! <\/p>\n\n\n\n

Our relational databases, graph databases<\/a>, and blob storage (which is used for data like your documents, images and video) are all secured with AES-256 encryption.\u00a0\u00a0<\/p>\n\n\n\n

Data in transit needs to be encrypted too. It also needs to travel light and travel fast. For that, we use Transport Layer Security 1.2+ (TLS). It\u2019s the same standard as you use for online banking, your data never leaves the data centre without it! <\/p>\n\n\n\n

Training <\/strong><\/h2>\n\n\n\n

Because brute force isn\u2019t much of an option\u2014unless you\u2019re an immortal hacker with a billion years to waste\u2014one of the biggest security threats to your people data is human error. Ransomware, business email compromise (BEC) and phishing<\/a>\u202fare currently amongst the most common threats.\u202f <\/p>\n\n\n\n

Of course, all our people attend security awareness training during onboarding and then monthly after that. And our engineers and data security teams undergo even more rigorous training. But we also offer training and guidance to you too. Which means you can use our system effectively, including leveraging all the security measures on offer.   <\/p>\n\n\n\n

Protecting your accounts <\/h2>\n\n\n\n

We\u2019re not just going to leave our customers to fend for themselves when it comes to securing access to their systems. That\u2019s why we\u2019re using the industry leading Microsoft Azure\u2019s Active Directory to keep your access credentials safe. You can secure your system access with email and password, of course, but we also offer multi-factor authentications using authenticator apps, SMS, telephone call, or even Security Keys and SAML SSO. <\/p>\n\n\n\n

We also have built-in systems for role-based access controls, so HR managers can limit access to sensitive data. By identifying key stakeholders, you can apply appropriate and consistent access permissions depending on policies, level of training, and roles. And after that access records are always logged. <\/p>\n\n\n\n

DevSecOps <\/h2>\n\n\n\n

\u2026 Ahem, that\u2019s development, security, and operations to the rest of us (…a friendly note from your editor) <\/p>\n\n\n\n

Our world-class engineers use the latest techniques to keep SenseHR secure and reliable. Every line of code that they write is peer reviewed by another engineer and scanned with industry leading tools, including Sonar Cloud. If any issues are found during these processes, the code cannot be deployed and is returned for further review. <\/p>\n\n\n\n

Security Monitoring <\/h2>\n\n\n\n

Engineers monitor our platform 365 days a year, 7 days a week, and 24 hours a day. All logs and metrics are sent to Azure Sentinel, which can detect malicious activity or incidents in real time. As soon as anything risky is detected according to predetermined threat thresholds, our engineers will declare an incident and raise a system alert. And our highly trained security incident response team takeover from there. <\/p>\n\n\n\n

Penetration testing and Bug Bounty <\/p>\n\n\n\n

Most HR platforms run a short pen test once a year. We have people testing the security of our platform constantly.  <\/p>\n\n\n\n

In fact, we\u2019re so invested in our security, that we\u2019ve teamed up with a leading bug bounty program. That means the most skilled security researchers in the world\u2014and even our own customers\u2014have a safe and official avenue for testing and letting us know of any vulnerabilities they find. Find one and we\u2019ll pay you a bounty.  <\/p>\n\n\n\n

1 tenant, 1 database <\/h2>\n\n\n\n

Most HR software providers store their customer data in shared database servers. Yup, if you and your greatest rival are using the same HR software, it\u2019s likely that you\u2019re sharing databases too. Unless you\u2019re using SenseHR that is. We give each of our customer organisations their own databases. Not only does that make things faster for everyone but it eliminates any risk of data leaking into that rival database.  <\/p>\n\n\n\n

And where\u2019s that database? <\/h2>\n\n\n\n

As standard we store your data in the Azure UK South datacentre in London. But that\u2019s because most of our customers are UK based, so it delivers a faster service. If, for any reason, you want your data to be stored in any one of the 200+ physical Azure datacentres around the world\u2014for your new Paris office, for example\u2014all you need to do is ask. We can move data wherever you want within the Azure infrastructure to support speed or regional data protection regulations.  <\/p>\n\n\n\n

Also, don\u2019t you mean databases (plural)? <\/h2>\n\n\n\n

Yup, our data redundancy measures means that your data is backed up across multiple servers. And those backups happen a lot. To be specific we perform: <\/p>\n\n\n\n