Security & GDPR
Your most sensitive data deserves the best protection
Salaries, health, performance, personal identity numbers. HR systems handle information that can hurt people if it ends up in the wrong place. That is why we built AltitudeHR with security as architecture – not as an add-on.
Security & GDPR
Who can see what?
Who can see what?
Permissions in AltitudeHR are not only role-based. They take context into account: a manager sees their own team, but not the team's salaries – unless you explicitly grant that right.
- CEO
- Salary: Full accessPerformance: Full accessHealth: No accessOwn profile: Full access
- HR admin
- Salary: Full accessPerformance: Full accessHealth: LimitedOwn profile: Full access
- Manager
- Salary: No accessPerformance: Own teamHealth: No accessOwn profile: Full access
- Employee
- Salary: Own onlyPerformance: Own onlyHealth: Own onlyOwn profile: Full access
Our principles
Permissions in AltitudeHR are not only role-based. They take context into account: a manager sees their own team, but not the team's salaries – unless you explicitly grant that right.
Least privilege
Nobody sees more than they need. Permissions are controlled per role, context and field.
Isolation by default
Every customer is strictly separated at every layer: database, API, background jobs and file storage.
Everything is traceable
Every sensitive read and change is logged with who, what, when and from where.
Data minimisation
We only collect what is needed and delete automatically according to your rules.
How we protect your data
Who can see what?
Permissions in AltitudeHR are not only role-based. They take context into account: a manager sees their own team, but not the team's salaries – unless you explicitly grant that right.
Data protection
- TLS for all traffic
- Encryption of data at rest
- Customer isolation at every layer
- Controlled document access – no public file links
Identity & access
- Role-based and contextual permissions
- Two-factor authentication
- Session management and secure cookies
- Configurable OIDC single sign-on and SCIM directory provisioning
Traceability
- Audit log
- Logging of sign-ins and sensitive changes
- Before-and-after history for every change
- Log export for audits
GDPR
- Data subject access and erasure
- Automatic retention rules
- Classification of sensitive fields
- Data processing agreement (DPA) for all customers
Secure development
- Code review of every change
- Automated security analysis (SAST) and dependency scanning
- Recurring penetration tests
- Tested backup and restore
Safe AI
- The AI follows the same permissions as the user
- Sensitive actions require human approval
- Every AI action is logged
- Your data is not used to train external models
Found a vulnerability?
We appreciate responsible disclosure. Email hello@altitudehr.se with the subject SECURITY – we acknowledge within two business days and keep you informed until the issue is resolved. We take no legal action against good-faith research that only touches your own accounts and data, does not affect others' availability and gives us reasonable time to fix the issue before publication.
/.well-known/security.txtRunning a security review?
We are happy to answer security questionnaires and share documentation about our architecture, processes and DPA.
AltitudeHR
Give your people the platform they deserve.
Get started in minutes. You will wonder how you ever managed without it.