Employee data. Treated like it.

What we hold — and what your law calls it ¶

No euphemisms first: the records we move are the sensitive kind. Employee master data includes bank details — and the government identifiers (SSS, TIN, PhilHealth, Pag-IBIG) that the Philippine Data Privacy Act classifies as sensitive personal information, its most protected tier, with the stiffest penalties attached. We designed for that classification from day one, because it's in the pipe from day one.

Lives in your systems, permanently

The employee record itself — names, salaries, bank details, government IDs — lives in your HRIS and your payroll system. We move it between them; we don't warehouse it. There is no third employee database to manage.

Passes through us, held 90 days

Record-level operational data: sync payloads, quarantined records, run logs — what the quarantine queue, the sync history, and your reconciliation reports run on. Encrypted at rest while it's with us; deleted on the 90-day rolling clock.

Two more things we hold, so the inventory is complete: your API credentials (in the secrets vault, until you revoke them) and your field-mapping documents (versioned — and yours).

And the handling doesn't wait for go-live: the same encryption, scoping, and retention rules apply from week-1 discovery onward, parallel run included — there is no separate "test mode" pipeline.

The scope isn't a policy sentence — it's a signed artifact. Every field that moves is named in your mapping document before we build: versioned, signed off, yours to keep. Nothing moves that isn't in it, and integration access is scoped to exactly it. When your DPO asks what this vendor holds, the answer is a signed document, not a reconstruction.

If you ever need us gone, you don't need us to agree

Security reviews are about worst cases. So run this one: you want us out — today.

• Suspend the service account in your own system. Every sync stops. No ticket to us, no notice period to cut our access, no cooperation required.
• There's nothing to uninstall. No agent on your servers, no middleware you licensed, no code you have to own. Switching us off leaves nothing behind. (Vendor-API connections — the default; custom connections define their model in the quote.)
• And nothing to retrieve. Your data was never only with us — the permanent copy sat in your systems all along. The record-level data we held — payloads, quarantined records, run logs — ages off the 90-day clock.

We'd rather you never reach for the off switch. But in our worst case, you hold it.

Leaving the contract is a different, calmer story — term end, with notice, no exit fee.

Where it lives, and for how long ¶

The platform runs on AWS in Singapore (ap-southeast-1) — and stays there: processing, backups, and support access are all in-region. What it keeps is deliberately small — and deliberately brief:

• What exists operationally is the record-level data named above — held because the quarantine queue, the sync history, and your reconciliation reports need a working window behind them. On a semi-monthly payroll calendar, 90 days is roughly six cycles of history: when payroll asks what synced two cutoffs ago, the answer is in the dashboard.
• Why not longer: Philippine privacy law's own principle is that personal data is kept no longer than the purpose needs — and a sync layer needs a window, not an archive. On day 91 a record-level payload is deleted on the rolling clock — backups included, they age off the same schedule — and the permanent record is where it always was: in your systems. What persists is run-level history and the monthly SLA figures your dashboard reports, not employee records.
• Why not shorter: because a quarantined record being fixed at the source, a failed run being re-run, and a cutoff sign-off being audited all need history behind them. Ninety days is sized to the job — not to building a shadow database.

Certifications & paperwork: what's true today ¶

You won't find a certification badge wall here. A seal you can't click through to a report is decoration — and AWS's certifications attest to AWS, not to us, so we won't borrow those either.

A row moves up when the paperwork is real — never before. It's the same rule our integration roadmap runs on: the status changes when reality does.

Whose data it is — in the law's own words ¶

• You are the personal information controller (PIC). Your company decides why employee data is processed, and for what. Hiring us changes none of that.
• We are your personal information processor (PIP). We process on your documented instructions — and the signed field-mapping document literally is the instruction set. Only what's in it moves.
• No data sharing — and never our own purposes. We never process your employees' data for our own ends: no analytics on your records, no model training, no product research. Which is also why the NPC's data-sharing-agreement rules don't apply here: what governs is the outsourcing agreement — the data processing agreement we sign with you, carrying the contents Philippine law requires of it.
• We will never ask your employees for consent. The lawful bases you already rely on as their employer — including the laws that require these identifiers to be processed for payroll in the first place — carry the processing; we inherit your instructions. A vendor bragging about collecting employee consent is telling you they don't understand employment data.

For your EU employees: the same posture in EU vocabulary — we act as a processor under Article 28, in the same agreement. And the honest transfer answer, before your counsel asks: Singapore holds no EU adequacy decision, so the DPA will incorporate the EU Standard Contractual Clauses (controller-to-processor module), with the technical-and-organisational-measures annex your transfer impact assessment needs.

Leaving, from a security seat ¶

Vendor-risk checklists end with "data return and destruction on termination." Our answer is short, because the architecture already gave it:

• Nothing needs returning — the permanent copy was in your systems all along, and cutting our access is a switch you already hold. The off switch is yours
• The 90-day clock keeps running after your last sync. Within 90 days of leaving, no record-level data of yours remains on the platform — and you get written confirmation when the deletion completes.
• The mapping documentation goes with you — versioned, complete, the artifact your next setup starts from.

A vendor you can leave cleanly is a vendor you can approve safely.

What this page doesn't claim — yet ¶

Security reviewers are trained to find the gap. Here's the list, so you don't have to dig:

• A SOC 2 report — not yet. The exact status. What stands instead: an architecture you can verify in one call, and an SLA whose service credits are in the contract → SLA & Support.
• NPC registration — lands with our legal entity: registration and DPO designation follow entity formation, and this line links the registration certificate when it's true. Status row
• A penetration test of this platform — not yet: the platform enters our standing third-party testing regime at launch. What stands meanwhile: the regime itself — regular pentests and vulnerability assessments across the engineering organization that builds it.
• ISO 27001 — not pursued at launch. One certification honestly finished beats two announced.
• A 24/7 security operations center — no. Automated monitoring watches every scheduled run around the clock; the humans work the published support hours — plus Premium's payroll-window on-call → support tiers, on the SLA page. We won't sell you a follow-the-sun team we don't have.
• A public status page — deliberate, not missing: the only status that matters is your own pair's, and your dashboard already shows it. → Why, on the SLA page

Every not-yet above is paired with the event that changes it; the rest are choices, and we've said why. A list like this is how you know the rest of the page means what it says.

Security questions, answered the way the questionnaire asks them ¶