Security
How we protect your payroll data.
Payroll holds the most sensitive records a company keeps. This is how Sahora looks after them.
What protects your data
Hosted in Singapore
The application and the database run in Singapore.Each company kept apart in the database
Row-level security separates every company's data in the database itself, and it is tested on every table.Two-step verification
An authenticator app is required for everyone who handles payroll, with two authenticators each, so losing a phone doesn't lock anyone out. Resets are recorded.ID and bank numbers encrypted
TIN, SSS, PhilHealth, Pag-IBIG and bank numbers are encrypted (AES-256-GCM) and masked by default. Every view and every export of a full number is logged.An activity log that can't be edited
Who changed what, when, with the values before and after. The log can only be added to.Sessions and sign-in
Idle sessions time out, repeated wrong passwords lock the sign-in for a while, and each person can see their signed-in devices and sign out of all of them.Payslips stay private
Payslip emails contain a link, never the payslip. Payslip PDFs are password-protected.Status in public
A public status page shows whether Sahora is up.Your data, kept and returned
Clock-in selfies are kept 90 days, time records 3 years and payroll records 10 years. You can export all your data at any time, and when a client leaves, its data is deleted with a certificate.
Data Privacy Act
Our data protection program is designed with legal input. Every user acknowledges the privacy notice, and data requests and breaches are logged in Sahora itself.
Status page: sahora status. Found a security issue? Please tell us through support@sahora.ph.