Why this matters here
TRACKK holds some of the most sensitive records an organisation keeps: salaries, bank and tax details, national identity numbers, attendance histories, medical and leave records, appraisals and disciplinary files. This page describes how we protect them and what we expect of you as a customer.
Where your data lives
TRACKK is available two ways, and the choice materially changes the security model:
- Cloud. We host and operate the platform. We are responsible for infrastructure, patching, backups and monitoring.
- Self-hosted. The platform runs on your own servers, inside your own network. Employee and payroll data never leaves your infrastructure, and we have no routine access to it. Infrastructure security, backups and availability become your responsibility, with our support during and after implementation.
Both options are described on the Packages page.
Encryption
All traffic to TRACKK is served over HTTPS using TLS, and plain HTTP requests are redirected to the secure equivalent. Data at rest on our cloud deployment is encrypted at the storage layer. Administrator and user passwords are never stored in readable form; they are stored as salted one-way hashes.
Access control
- Access inside a customer account is role-based, so payroll, disciplinary and personnel records are visible only to the roles your administrators authorise.
- Administrative sessions are protected with HttpOnly, same-site session cookies and expire automatically after a period of inactivity.
- Sign-in attempts are rate-limited per source address to blunt brute-force and credential-stuffing attempts.
- Our staff do not access customer data as a matter of course. Where support work requires it, it is on your request and limited to what the task needs.
Application hardening
- Every form that writes data is protected against cross-site request forgery.
- Public endpoints - contact, demo, careers, partner applications and the free HR tools - carry their own rate limits and a challenge step, so they cannot be used to flood the system or harvest resources.
- Uploads are restricted by file type and size, and stored under generated names rather than the name they were uploaded with.
- Data access runs through parameterised queries, so user input is never concatenated into SQL.
- Administrative areas are excluded from search engine indexing and are unreachable without authentication.
Backups and continuity
Cloud deployments are backed up on a regular schedule, and restores are tested. Retention periods and any recovery objectives that apply to your account are set out in your subscription agreement. For self-hosted deployments, backup and disaster recovery sit with you; we advise on a suitable approach during implementation.
Logging and audit trail
The platform keeps an audit trail of significant actions, including record changes, payroll runs, approvals and disciplinary case activity, so you can reconstruct who did what and when. Server-side request logging supports security monitoring and fault diagnosis.
Incident response
If we become aware of a security incident affecting your data, we investigate immediately, contain it, and notify affected customers without undue delay along with what we know and what we are doing about it. Where the law requires notification to a regulator or to individuals, we support you in meeting it.
Data retention and deletion
We keep data only as long as your agreement and applicable law require. You can export your data during your subscription and during the export window after it ends, after which we delete or return it as agreed. Retention specifics are in our Privacy Policy.
Privacy and regulatory alignment
We operate as a data processor for the employee data in your account and act on your documented instructions. Our practices are built around established data protection principles - lawful basis, purpose limitation, data minimisation, storage limitation and the right of individuals to access and correct their records. A data processing agreement, our sub-processor list and answers to a security questionnaire are available to customers and prospects on request.
If your procurement process requires evidence of a specific certification or audit report, contact us at security@trackk.app and we will tell you exactly what we can currently provide.
What we ask of you
- Give each person their own account; never share credentials.
- Review role assignments regularly, especially access to payroll and personnel files.
- Remove accounts promptly when someone leaves.
- Keep a lawful basis and the right employee notices in place for the data you upload.
Reporting a vulnerability
If you believe you have found a security issue in TRACKK, email security@trackk.app with enough detail to reproduce it. Please give us a reasonable window to investigate and fix before disclosing publicly, and do not access, modify or exfiltrate data belonging to anyone else while testing. We will acknowledge your report and keep you updated.