Version 2026-11-01. Effective 1 November 2026.
1. Who this applies to
1.1. This policy applies to every person who uses Sahora: client owners and their users, employees using the portal, accounting firm staff, people using the API, and visitors to the website. It is part of the Sahora Terms of Service of JTL Advisory and Business Solutions Inc. ("JTL", "we").
1.2. A client is responsible for making sure its users follow this policy.
2. Use Sahora for its purpose
2.1. Use Sahora only for:
- your company's own payroll, timekeeping and HR records; or
- if you are an accounting firm, the payroll of clients that engaged your firm in writing; or
- if you are an employee, your own records and requests.
2.2. Enter only personal information you are allowed to process, for a lawful purpose, after giving the people concerned the notices the Data Privacy Act requires.
2.3. Do not use Sahora to keep records of people who are not your employees, applicants you are onboarding, or others your records properly need (for example, a previous employer named on a BIR Form 2316).
3. Accounts
3.1. Use only your own sign-in. Do not share it, sell it, or let anyone else use it.
3.2. Do not create accounts or companies to get around plan limits or the Free Plan rules (one Free Plan per person and per business), and do not give false details when signing up.
3.3. Keep your authenticators safe. Tell us at once if you think your sign-in was misused: support@sahora.ph.
4. Security
Do not:
4.1. try to reach data of another company, another employee, or any record your role does not allow;
4.2. probe, scan or test the security of Sahora without our written permission (see section 7 for reporting a problem you found);
4.3. get around sign-in, two-step verification, rate limits, clock-in checks or other security controls;
4.4. upload files that contain malware, or that are designed to harm Sahora or its users;
4.5. copy, reverse engineer or decompile Sahora's software, except to the extent the law allows;
4.6. use automated tools to scrape the website or the app, except through the API with your own keys and within its limits.
5. Fair use of the service
Do not:
5.1. overload Sahora, or use it in a way that harms other clients' use (for example, sending more API requests than Sahora's rate limit, or repeatedly running very large jobs without need);
5.2. use Sahora to send unsolicited messages, or to send messages that are unlawful, abusive or misleading (for example, through announcements to employees, payslip questions or request comments);
5.3. use Sahora to break any law, including labor, tax, social security, data privacy and anti-fraud laws.
6. Timekeeping and clock-in
6.1. Employees must clock in only for themselves, with their own phone, at the real time and place.
6.2. Do not use photos, videos, virtual cameras, location spoofing or another person's phone to make a punch.
6.3. Employers must use timekeeping data (location, selfies, phone details) only to confirm attendance and settle questions about attendance and pay, as their notice to employees says, and must give employees a way to have a person review a refused or rejected punch.
6.4. Employers must not turn on face matching without first telling the employees concerned and recording each employee's consent in person.
7. Reporting security issues
If you find a security weakness, tell us at support@sahora.ph, or through the details in Sahora's security.txt file. Please give us a reasonable time to fix it before telling anyone else, do not access or change other people's data, and stop once you have found the issue. Reporting does not authorize any testing that section 4 does not allow.
8. What we may do
8.1. If this policy is broken, we may, depending on how serious it is:
- ask the client to fix it;
- remove the content concerned;
- suspend the user, the API key or the workspace; or
- end the agreement under the Terms of Service.
8.2. We act at once without prior notice when needed to stop a security threat, protect other clients or users, or comply with the law. Otherwise we give written notice and 15 days to fix the problem first.
8.3. During a suspension, the client's owners can still export the client's data, unless the law or the security threat prevents it.
8.4. We may report unlawful activity to the authorities.
9. Contact
Questions about this policy: support@sahora.ph.