How Praxis protects your people's data.
HR and payroll hold the most sensitive information a company has. This page describes the protections built into Praxis, as they work today.
Signing in
- Microsoft or email sign-inStaff sign in with their Microsoft account or with an email and password. A company can make Microsoft sign-in the only option for its staff.
- Strong passwordsPasswords are at least 12 characters and stored only as bcrypt hashes.
- Two-factor sign-inPassword accounts can add authenticator-app codes, with single-use recovery codes. A used code can't be replayed.
- Lockout and rate limitsRepeated failed sign-ins lock the account for a while, and sign-in and password-reset requests are rate-limited. Responses don't reveal whether an account exists.
- Sessions that endSessions expire after inactivity and after a fixed daily limit. Changing a password, or choosing "Sign out all devices", ends every other session.
Who can see what
- Role-based accessEvery action is checked against the person's role. Built-in roles cover HR, line managers, Finance, credit officers and employees, and administrators can create custom roles.
- Team scopeLine managers see their direct reports. Employees see their own records.
- No approving your own requestsNo one approves their own leave or loan, and the person who submits a payroll run can't approve it.
- No granting more than you holdAn administrator can't give anyone permissions they don't hold themselves.
Protecting the data
- Encrypted identifiersBVN, NIN, TIN, pension PIN and bank account numbers, two-factor secrets and integration secrets are encrypted in the database with AES-256-GCM.
- Bank details guardedChanging your own bank details needs your password, and you're notified by email when they change.
- Secure linksOnboarding, guarantor and password-reset links are stored only in hashed form and expire.
- Archived, not destroyedDeleted HR records, such as employees, leave and payroll, are archived rather than erased, so their history is kept.
- Safe exportsCSV exports neutralise formulas, so a downloaded file can't run a formula when it's opened in a spreadsheet.
Oversight
- Audit trailChanges are recorded with who made them and the values before and after. Passwords and secrets are never written to the log, and ID and bank numbers are masked.
- Searchable and exportableAdministrators can filter the audit log by person, module, action and date, and export it.
Where Praxis runs
- Your own deploymentEach customer gets a separate Praxis deployment and database. Your records are never stored alongside another customer's.
- Hardened web layerPages are served with a content security policy, HSTS and protection against being framed by other sites.
We describe mechanisms, not certifications. Praxis does not currently claim compliance with any standard or regulation. To report a security issue, email [SECURITY CONTACT].
Questions about how we handle your data?
Ask us during a demo and we'll walk you through how Praxis handles your data.