Security

This page explains how PerfTrack protects your company's data and your employees' information, and what remains your organisation's responsibility. It forms part of our Data Processing Agreement.

Data Encryption

• In transit: All data between your browser and our servers is encrypted using TLS 1.2+ (HTTPS). Your browser will show a padlock icon confirming this.
• Passwords: Passwords are hashed using bcrypt before storage. We never store plaintext passwords.
• Payment data: We never store credit or debit card numbers. All payment processing is handled by Flutterwave, a PCI DSS-compliant payment provider.

Authentication and Sessions

• Email addresses must be verified before an account can sign in
• Passwords must meet length and complexity requirements
• Repeated failed sign-ins temporarily lock the account, and sensitive endpoints are rate limited
• Sessions are signed tokens that expire after 4 hours
• HTTP-only, same-site cookies prevent JavaScript access to session tokens, and anti-forgery (CSRF) protection applies to requests that change data
• Signed-in endpoints that read or change organisation data require valid authentication
• Each organisation's data is kept separate; users can only reach data that belongs to their own organisation

Infrastructure and Sub-processors

• Hosted on Render, whose platform is SOC 2 Type II audited by the provider
• PostgreSQL database with automated backups managed by our hosting provider
• Automatic SSL certificate management via Let's Encrypt
• Uploaded documents are stored with Cloudinary; transactional email is sent through Brevo; payments are handled by Flutterwave
• Regular dependency updates to patch known vulnerabilities
• The full list of sub-processors and what each does is in the Annex to the DPA. We will notify customers before adding or replacing one.

Access Controls

• Role-based access: administrators can create roles and grant or remove individual permissions, such as payroll, HR records or leave approval
• Full administrators can view and manage all data within their organisation
• By default, employees can only see their own records plus the shared staff directory
• No cross-organisation data access is possible through the product
• Security events (sign-ins, failed attempts, access-control events) and key application events are logged
• PerfTrack personnel access customer data only where needed for support, security, billing or legal compliance, and are bound by confidentiality

Incident Response

If we become aware of a personal data breach affecting data we process for your organisation, we will notify your administrator without undue delay and in any event within 48 hours of becoming aware of it, with the information we have at that point, and update you as we learn more. Your organisation, as the data controller, decides whether notification to the Nigeria Data Protection Commission and to affected individuals is required, and we will help you with the information you need.

Shared Responsibility

Security is shared. We protect the Service and its infrastructure. Your organisation is responsible for:

• Choosing who gets administrator and role-based access, and removing access promptly when people leave
• Making sure users choose strong, unique passwords and do not share accounts
• Securing the devices and networks used to access PerfTrack
• Protecting anything exported or downloaded from PerfTrack, such as CSV exports and payslips, which are outside our control once they leave the Service
• Telling us promptly if you suspect an account has been compromised

Our security measures reduce risk but cannot remove it entirely. See the Terms of Service for the limits on our liability.

Reporting a Vulnerability

If you discover a security vulnerability in PerfTrack, please report it responsibly by emailing hello@perftrackapp.com with the subject line "Security Vulnerability". We will acknowledge your report within 48 hours and work to resolve confirmed issues promptly.

Please do not publicly disclose the vulnerability until we have had a reasonable opportunity to address it, and do not access, change or delete data that is not yours while testing.

Contact

For security-related questions, contact us at hello@perftrackapp.com.