How We Protect Your Data
We handle contractor identity and payout details, so this page sets out what is in place today and what is still ahead of us — rather than a wall of badges.
In place today
Each of these is something we can walk through with your security team.
Encryption in Transit and at Rest
All connections are served over TLS. Application data is held in a managed Postgres database with encryption at rest enabled by the provider.
Payout Details and Tax Numbers Encrypted
Contractors’ bank and e-wallet details and tax numbers are encrypted by our application before they are stored, on top of the database’s own encryption.
Role-Based Access Control
Company, contractor, and platform administrator roles are separated at the application layer. Each company sees only its own people, and a password reset or a removed login ends that person’s sessions straight away.
Payment History
Every change to a payment’s status is recorded with who made it and when. The platform only ever adds to that history; it never edits or removes an entry.
Managed Infrastructure
We run on managed platforms rather than self-administered servers, so patching, network isolation, and physical security sit with providers who specialise in it.
Philippine Data Privacy Act
We process personal data under the Data Privacy Act of 2012 (RA 10173). Our privacy policy sets out what we collect, why, and the rights available to data subjects.
Where your data runs
We use managed platforms rather than running our own servers. Our current subprocessors:
| Layer | Provider | Holds |
|---|---|---|
| Web application | Vercel | Application hosting and edge delivery |
| API | Fly.io (Singapore) | Request handling and business logic |
| Database | Neon (Postgres) | Contractor, company, and payment records |
| SMS | Semaphore | Contractors’ mobile numbers, to send sign-in codes and payment-sent texts |
Data is processed outside the Philippines by these providers. The Data Privacy Act permits this where appropriate safeguards are in place, and our privacy policy sets out how we handle cross-border transfers. We will confirm current processing regions in writing on request.
Not yet in place
We are early, and it is more useful to you that we say so. These are on the roadmap and are not implemented today.
- Third-party penetration testing, with the report available under NDA
- SOC 2 Type I readiness assessment
- Multi-factor authentication for client and administrator accounts
- An audit history for every change to contractor records, alongside the payment history already kept
- A published uptime target backed by a contractual service level
Running a security review?
Send us your questionnaire. We will answer it as it stands rather than deferring to a certification we do not hold, and we will tell you plainly where a control is planned rather than live.
Questions about security?
Talk to us about your requirements before you commit to anything.
Schedule a consultation