Data protection, in plain terms

This page explains how HRHive looks after the personal data your organisation keeps in it, and the tools it gives you for your own data protection duties. Each fact below is something HRHive does today. Where something is not in place, we say so.

The facts

How it works

Organisations are kept apart. Row-level security is a database feature that controls which rows of data each request can reach. HRHive applies it to every table that holds organisation data, so each organisation's data is kept apart in the database itself.

The most sensitive details are encrypted individually. Date of birth, National Insurance number and bank details are each encrypted with AES-256-GCM, using a separate key for each organisation. The encryption page explains what is encrypted and what is not.

Sensitive fields follow roles. HRHive has eight roles: owner, admin, HR, manager, payroll, compliance, employee and a read-only auditor. Fields such as bank, salary, National Insurance and medical details are shown only to the roles that need them.

Share codes are not kept. After a right to work check, only the last three characters of the share code are kept.

Every kind of record has a retention period. Retention periods are set for each kind of record. A legal hold stops a record being destroyed while it is still needed, and the destruction log is the record of what has been destroyed.

Requests, complaints and notices are tracked. Data requests are tracked against a one-month clock and data protection complaints against a 30-day acknowledgement. Privacy notices are tracked too.

No trackers in the app. There are no advertising or analytics trackers inside the application.

What it means for you

• When someone asks for a copy of their data, the request and its one-month deadline are tracked in one place.
• Someone whose role does not need bank or salary details does not see them.
• Each kind of record has a retention period, and a legal hold stops a record being destroyed while you still need it.
• Your organisation still decides what to record, tells its people how their data is used and answers their requests. HRHive gives you the tools and keeps the record of what was done.

What we do not claim

• Automatic redaction. When you export an access request, HRHive flags what may need redacting. It does not redact automatically, so a person needs to check the export.
• Encryption of everything. HRHive encrypts the three fields named above. Other data is protected by access controls rather than by additional encryption in the application.
• Where data is stored. We will publish the location of customer data once it is confirmed. Until then, we do not state one.
• Finished legal documents. Our terms, privacy notice and data processing agreement are being finalised. They will be published on our legal documents page once a solicitor has reviewed them.