Security
Orvo HCM holds some of the most sensitive records a company keeps, so protection is built into its foundation. Each protection below is in the product today. SOC 2, at the end of the page, is a goal we are working toward.
In the product today
On every table that holds a workspace's data, the database itself keeps each workspace apart, and a test suite that runs two workspaces side by side proves it. The application reaches the database through a role that cannot switch this protection off.
Identity numbers, medical details, stored documents, and every field you classify as sensitive are encrypted with a separate key for each workspace. They are masked in logs and in the audit trail, and only people granted access to those fields can read them.
Every change is recorded with who made it, when, and what it was before and after, in the same step as the change itself. Entries cannot be changed once written, sensitive values in them are masked, and even reading identity or banking fields is recorded.
In every new workspace, anyone who can see or change other people's sensitive data must sign in with two steps, and can do nothing else until it is set up. Everyone else can turn it on for their own account.
A new workspace can be placed in a database of its own, named for it and holding no one else's data. It runs the same code, and the database still enforces isolation inside it.
Administrators can export the workspace's data once a day at most: every table of the workspace's data as a CSV file, with the stored documents; sign-in secrets and keys are left out. Only an administrator who signed in with two steps can ask for an export, and it is encrypted with the workspace's key and kept for seven days.
Orvo HCM asks biometric devices for attendance lines only and never stores a fingerprint or face template, so templates stay on the device and Orvo HCM's API never returns them. Someone can be set up to verify by fingerprint or face only once their consent date is on record, and a punch verified that way without one is flagged for review. A card or PIN is always available instead.
Prosigns staff run the service from a separate console with its own sign-in, which requires an authenticator code. The console never shows your employees' records: it sees only a short list of facts about a workspace, such as its companies and how many employees are active, and every action taken in it is logged.
Every file uploaded to Orvo HCM is checked by its content rather than its name, kept within a size limit, and scanned for malware before it is used.
Our goal
Our goal is to be ready for a SOC 2 examination by the time Orvo HCM is generally available as a service. Until then we make no SOC 2 claim, and we will say so on this page when that changes.
Send us your security questions, and we will answer them in writing or walk your team through these protections in a demo.
