Transport encryption
HTTPS with TLS on every connection, including desktop tracker uploads. HTTP requests are redirected rather than served.
Trust
Security and data protection
Attendance records, work reports and screenshots are employee personal data. This page sets out how that data is protected, who can reach it, and what we do not claim.
- TLS everywhere
- Custom roles
- Audit log
- Optional 2FA
What we do not claim
Worth putting first, because it is the paragraph most vendor security pages leave out.
Employee Desk does not hold any security certification. If your procurement process requires a certified platform, tell us what it needs. We will not imply a certification we do not hold.
Application security
Authentication
Hashed passwords, session expiry, optional TOTP two-factor for administrators, and a signed-in devices list where any session can be revoked. Revoking a user signs them out everywhere.
Role separation
Custom roles built from individual permissions, each scoped to own, team or all records. A team lead can see their team without seeing the whole company.
Audit log
Who changed what, and when: users and access, roles, organization settings, sessions revoked, billing and every payroll action. Viewing a screenshot is permission-controlled but not logged as an event.
File handling
Uploads are stored outside the web root. Screenshots and documents are served through signed, short-lived links issued only after a permission check, rather than from a guessable public URL.
Data isolation
Every organization is its own isolated workspace with its own users, roles, settings and logo. Tenant scoping applies to every query on the shared cloud.
Data protection and Indian law
Employee attendance, activity and screenshot data is personal data. Under the Digital Personal Data Protection Act framework, the employer processing it is the entity with obligations to its employees, and the four that matter operationally are notice, purpose limitation, storage limitation and security.
- Notice. Employees must be told what is collected. The product supports this by design: the tracker is visible, screenshots trigger a notification, and every employee can see their own record. The written policy is still yours to publish.
- Purpose limitation. Collect what the business purpose needs. If hours are the question, run the tracker with screenshots off — that is a supported configuration, not a degraded one.
- Storage limitation. Configure retention rather than keeping captures indefinitely.
- Security. Role-based access and the audit log.
Where you are the data controller and we host the platform, we are a processor acting on your instructions. This is general information rather than legal advice; confirm your position with your own counsel, particularly if you employ people outside India.
Reporting a vulnerability
If you believe you have found a security issue, email support@employeedeskcrm.com with the subject line Security. Include enough detail to reproduce it. We will acknowledge, investigate and tell you what we found.
Please do not test against another customer’s data.
Security questions
Is Employee Desk ISO 27001 or SOC 2 certified?
No. We are not going to claim a certification we do not hold. The controls described on this page are what is implemented.
Is data encrypted?
All traffic uses HTTPS with TLS. Passwords are stored only as salted hashes, two-factor secrets are stored encrypted, and files such as screenshots are served through signed links that expire shortly after they are issued.
Who inside our company can see screenshots?
Only roles you grant, granted with an own, team or all scope, so a manager only reaches the people they are allowed to. The employee can always see their own.
Do you have access to our data on the cloud?
Access is limited to the small number of people who operate the platform and is used only for support and incident response.
What happens in a security incident?
We investigate, contain, and notify affected customers with what we know, what we do not yet know and what we are doing about it.
Do you support single sign-on?
Not today. There is no SAML, OIDC or directory sync. Sign-in is password sign-in, optional TOTP two-factor for administrators, and a list of signed-in devices that can be revoked.
Can we get a penetration test report?
Tell us what your procurement process needs. We can discuss testing arrangements under NDA.
Send this page to your security reviewer
If something they need is missing from it, tell us and we will add it here rather than answering it once in an email.
- 7-day trial
- No credit card
- Cancel anytime