Security
Safe, secure and private.
Nexa People holds some of the most sensitive data a company has: pay, identity documents and attendance. Here is exactly how we protect it, and what we do not claim.
Data protection
Your employees' records are yours. They are kept apart from every other customer's and travel to you encrypted.
Tenant isolation
Every employee, payslip, punch and setting belongs to exactly one organisation and is scoped to it on every request. One customer's users cannot reach another's data.
Encryption in transit
Traffic between your browser or the mobile app and the platform is encrypted with TLS, using certificates issued and renewed automatically.
Biometrics stay on the device
Fingerprint and face templates never leave your terminals. Nexa People receives a punch code and a time, nothing more.
Limited access on our side
Our own access to customer data is limited to what running and supporting the service genuinely requires.
Access and identity
Decide exactly who can see and change what, down to individual forms and actions, and where people can check in from.
Roles and permission templates
Access is set by role tiers and permission templates that you configure, so a line manager, an HR officer and a payroll lead each see only their part.
Sign-in tied to employment
Sign-in only works while the account is active and the employee has not left, so a leaver's access ends with their exit.
Checked check-ins
Mobile punches can be required to come from a geo-fenced site, an approved network or a registered device, with a selfie where you need one.
Password resets by your admin
There is no self-service password reset. Your own HR administrator resets access from the employee record, which closes a common route for account takeover.
Accountability
Every important change has a name, a time and a reason attached, so you can answer an auditor or an employee with evidence.
Audit log
Privileged and business-significant actions are written to an audit log, along with sign-in events and IP addresses.
Approvals on record
Leave, overtime, corrections, expenses and pay changes move through approval chains, and every decision stays on the record.
An AI agent that asks first
Nexa, the built-in agent, works with the permissions of the person using it, asks before it changes anything and keeps a record of what it did.
Breach notification
If a breach affects personal data, we notify affected customers without undue delay and support their own reporting duties.
What we do not claim
We would rather lose a checkbox than pass one on a claim we cannot evidence.
- No ISO 27001 or SOC 2 certificate yet. When that changes it will appear here with its evidence, not in a sales deck.
- No published uptime figure. We do not publish a number we have not measured.
- Encryption at rest, key management and data residency: ask us, and we will tell you exactly what is and is not in place today.
Reporting a vulnerability
Responsible security research is welcome.
Write to [email protected] before you test, and we will agree the scope with you. We will not pursue good-faith research that follows what we agree.
Read how we handle personal data in our Privacy Policy.