Security built
into the platform.
Access is controlled through authentication, roles and permissions — with data protected through layered platform controls. We list only what is implemented. We do not claim certifications we don’t hold.
Suggested wording from plan §19: “Security is built into the architecture of ZapHRMS, with access controlled through authentication, roles and permissions and data protected through layered platform controls.”
What is
actually built in.
Login, session, password handling — login.webp.
Roles bound to users — role-permissions.webp, payroll-role-permissions.webp.
Module & field-level permissions — configuration per tenant.
Architectural isolation per organization — data does not cross tenants.
Activity logs, payroll activity logs, audit-logs — trace every change.
Secure API access and backups — plus encrypted communication in transit.
Controlled document access — who can view/download generated docs.
Payroll role permissions & activity logs — segregation for payroll.
Configuration is permission-controlled — configuration.webp, master-settings.webp.
Encrypted everywhere —
at rest, in transit, between services.
Data is protected at every layer — not just at the login screen. From browser to service to database, communication is secured and sensitive fields are stored encrypted.
All persisted data is encrypted at rest — databases, object storage and backups are encrypted with platform-managed keys.
Every external connection is secured with SSL/TLS (HTTPS). HSTS and modern cipher suites enforced.
Internal service-to-service calls and application-to-database connections are encrypted with secure SSL/TLS — no plaintext hops inside the platform.
Sensitive data such as bank account numbers and password material are encrypted before storage and decrypted only with scoped access. Passwords are hashed with strong adaptive hashing.
API keys, tokens and secrets are stored encrypted and never logged. Access is audited via activity logs.
Backups inherit at-rest encryption and are tested for restore. Access is permission-controlled.
Your domain.
Your identity.
Run ZapHRMS on your own domain and connect it to your existing identity provider — without a separate password silo.
Bring your own domain (e.g., hr.yourcompany.com) with managed TLS certificates, automatic renewal and enforced HTTPS. Clean branding and cookie isolation per tenant.
Easily integratable to your organization’s Single Sign-On. Supports SAML 2.0 / OIDC based SSO with your IdP (e.g., Azure AD, Okta, Google Workspace, OneLogin) — centralized provisioning, deprovisioning and access policies.
Works with existing role & permission model — SSO authenticates, ZapHRMS authorizes.
Custom domain + SSO + role-based access + tenant isolation = consistent identity from login → permission → audit log. No parallel user store.
custom domain
SAML / OIDC