Companies trust BeeHR with their employees’ pay, documents and personal details. This page describes how we protect them. It’s part of our data processing agreement.

Where BeeHR runs

  • BeeHR runs on Amazon Web Services in Frankfurt, Germany, and its database on Neon, in the same region. Their data centers are certified to international security standards, such as ISO 27001 and SOC 2.
  • Our websites and files are delivered through Amazon CloudFront.

Encryption

  • Every connection to BeeHR, from a browser or from the app, is encrypted (HTTPS).
  • Stored data is encrypted: the database, the files and the backups.
  • Files attached to a report in SpeakUp are encrypted with a key of their own, kept apart from the others.

Signing in

  • Passwords are kept only in a scrambled form (scrypt) that can’t be turned back into them.
  • After too many wrong attempts, a sign-in is locked for 15 minutes.
  • Anyone can turn on two-step sign-in with an authenticator app.
  • In a browser, the sign-in is kept in a cookie that the page’s scripts can’t read and other sites can’t use. On a phone, it’s kept in the phone’s secure storage.
  • Each sign-in is a session you can end. A stolen sign-in token that is used twice ends the session.

Who can see what

  • Each company’s records are kept apart from every other company’s, and every request is checked against the company it belongs to.
  • Inside a company, roles and permissions decide what each person can see and do. The company sets them.
  • Changes made in the dashboard are recorded: who changed what, and when.

Our own staff

  • Only staff who need it can reach the systems that run BeeHR, with their own sign-in and two-step sign-in.
  • When a company asks our support for help, they open its BeeHR in a read-only session that ends on its own. Each session, and each action our staff take for a company, is recorded.
  • Our staff are bound to keep what they see confidential.

Backups and recovery

The database is backed up continuously and can be restored to a point in time. Backups are kept for up to 35 days, in the same region.

Breaches

If a breach of security affects personal information, we tell the companies affected without undue delay, and within 72 hours, as our data processing agreement sets out.

Report a security problem

If you find a weakness in BeeHR, please tell us through our contact form, topic “Security report”, with what you found and how to see it. Please don’t use it to reach other people’s information, change or delete data, or disrupt the service, and give us a reasonable time to fix it before you tell anyone else. We’ll answer, and keep you informed while we fix it.