Platform
Security & Compliance Readiness
HR & OMS holds attendance records, payroll figures, government identifiers, and door access logs. This page sets out how that data is protected, what evidence the platform can produce for an audit — and, just as plainly, what we do not claim.
How Your Data Is Protected
Sensitive identifiers are encrypted, not just access-controlled
Government identifiers — SSS, PhilHealth, Pag-IBIG, TIN and similar — are routed through a tokenization vault using AES-256-GCM authenticated encryption, following NIST SP 800-111 guidance for data at rest. They are never written as plain text anywhere else in the system.
- Only roles explicitly granted vault access can view a decrypted value; everyone else sees it masked.
- Every decryption is written to a token access log — who viewed which value, and when.
- An administrator having database access does not, by itself, yield readable identifiers.
Tenant isolation enforced by the database, not by application code
Each organization's data is separated by PostgreSQL row-level security,
applied with FORCE so the policy binds even for the role that owns the tables.
A query that forgets to filter by tenant returns nothing rather than another
organization's rows.
This matters because the common alternative — a
WHERE tenant_id = ? the application is trusted to remember — fails open.
One missed filter in one query is a cross-tenant leak. A database-enforced policy fails
closed instead.
Documents have no public URL at all
Payslips, contracts, and ID documents are stored as bytes inside the database rather than as files on a web-served volume. There is no path a browser can reach directly — every read passes through a permission check first, and every download is logged.
Files on a shared media volume are typically served by the web server with no permission check whatsoever; anyone holding or guessing the URL gets the bytes. Storing them in the database removes that path rather than guarding it.
The Evidence an Auditor Asks For
Most audit findings come down to one question: can you show what happened, and when? The platform keeps timestamped, exportable trails across four separate areas.
Physical access
Every door attempt — granted and denied — with card, reader, and timestamp. Denials are the half most systems discard.
Record changes
Who changed which record, when, and what the value was before — including approvals and attendance corrections.
Sensitive-data views
Each decryption of a vaulted identifier is logged against the person who requested it.
Notifications sent
A delivery record for every message the system sent, so "were they told?" has an answer.
Access Control and Session Handling
Per-module, per-role permissions
Every module — payroll, attendance, documents, the vault, the CMS — is independently set to View, Manage, or no access for each role. A role change takes effect immediately, without the user signing in again.
Bounded sessions
Sessions carry both an idle timeout and an absolute maximum lifetime, so an unattended browser on a shared workstation does not stay signed in indefinitely.
Recoverable deletion
Removing a user or a document marks it deleted and keeps it recoverable, rather than destroying the record an investigation might need.
Offline-tolerant, not offline-blind
On-site controllers keep logging taps through a network outage and sync when the link returns — a power blip does not erase a day of attendance evidence.
Stated plainly
What We Do Not Claim
Cebuapptronix does not currently hold ISO 27001, SOC 2, or any equivalent third-party security certification, and HR & OMS is not advertised as certified under any of them. Where this site mentions SOC 2 or ISO auditors, it refers to your audit — the platform is built to produce the access and custody evidence those reviews ask for, which is a different claim from holding the certification ourselves.
We would rather tell you this up front than have your procurement team discover it. If a certification is a hard requirement for your organization, say so early and we will tell you honestly whether we can meet the timeline.
Built to Be Certifiable
The controls a certification audit examines — encryption at rest, enforced access separation, immutable audit trails, bounded sessions, least-privilege roles — are built in rather than bolted on. That is the groundwork a future certification rests on, and it is useful to your own compliance reporting today regardless.
Talk to us about your requirements Read the privacy policy