How we protect your payroll data.
Payroll and employee data is sensitive by default. Here's exactly what's in place today, in plain terms — no vague "bank-grade" claims without substance behind them.
Authentication & sessions
Sign-in uses signed JWT tokens (HS256) delivered as an httponly cookie, so tokens aren't accessible to page scripts. Every token carries an expiry, and role/tenant claims are verified on every request before any data is returned.
Password storage
Passwords are never stored in plain text. They're hashed using industry-standard algorithms before being written to the database — we never see or store a recoverable copy of your password.
Role-based access control
Every route is protected by role checks — SuperAdmin, Payroll Admin, and Employee each only reach the data and actions their role permits. Custom per-tenant roles let you define finer-grained permissions on top of the base roles.
Tenant isolation
Every record in the system is tagged and scoped to a tenant. Queries are always filtered by the authenticated user's tenant, so one organization's payroll data is never visible to another's.
Structured activity logging
Requests are logged as structured, tenant-tagged JSON — capturing who did what, from which role, and when — so admins have an audit trail to review, not just raw server logs.
Secure response headers
Every response sets security headers by default — HSTS, X-Frame-Options, and no-store cache directives on sensitive pages — to reduce common browser-level attack surface.
Data Residency & Compliance
- ✓ India-based servers: All employee and payroll data stored on Tier-1 Indian data centers (AWS/GCP India region)
- ✓ Zero data export: Personal and payroll data never leaves India, complying with RBI data localization guidelines
- ✓ DPDP Act 2023 ready: Full compliance with India's Digital Personal Data Protection Act 2023
- ✓ No government backdoors: Data access strictly limited to authenticated users within your organization
- ✓ 7-year retention: All payroll and audit records maintained for compliance archival
Certification Timeline
We're building security-first from day one. Certifications coming:
- 🔄 SOC 2 Type II: Q2 2027 — completing 6+ month audit trail
- 🔄 ISO 27001: Q4 2027 — formal information security management certification
- ✓ OWASP Top 10: All current safeguards implemented (no SQL injection, XSS, etc.)
- ✓ GDPR-compatible: Ready for global companies with Indian employees
- ✓ Secure by default: HTTPS/TLS 1.3, HSTS, CSP headers, password hashing (bcrypt)
While pursuing formal certifications, we maintain a detailed security audit trail available on demand for your compliance reviews.
Where we are today
Grapeit is currently pre-launch and in stealth mode. In the interest of not overselling: we do not yet hold formal certifications like SOC 2 or ISO 27001, and single sign-on (SSO) is on our roadmap but not yet built. If your organization requires either as a condition of purchase, tell us during a demo — we'll give you a straight answer on timeline rather than a vague "coming soon."
What's described above — authentication, hashing, RBAC, tenant isolation, and audit logging — reflects what's actually implemented in the product today, not aspirational roadmap items.
Have a specific security question, or found an issue?
We'd rather hear about a problem from you than from a headline.