Data protection

Each client company is the controller of its employees’ data. Hencora acts as a processor: the platform processes this data on the company’s instructions, to provide it with the service, and uses it for no other purpose.

For the data of the public site and accounts (sign-up, sign-in, contact), Hencora is the controller: Hencora, registered office address, Switzerland, suite@hencora.ch.

• Account: last name, first name, email address, role in the company, language.
• Working time: arrivals, breaks, departures, hours entered, project, notes, absences and holiday requests, hour balances and monthly approvals.
• Personnel file: contact details, AHV number, IBAN, work permit, contracts, certificates and other documents uploaded by the company, family allowances.
• Expenses: expense claims, photographed receipts, mileage.
• Invoicing: clients, items, quotes, invoices, payments and reminders.
• Technical: access logs, IP address, device and browser type, needed for the security of the service.

Hencora sells no data, passes none on for advertising purposes and does not use client companies’ data to train artificial intelligence systems.

• Providing the agreed service: keeping working time records, managing absences, preparing payroll, issuing invoices.
• Meeting legal obligations: working time records (Art. 46 ArG, Art. 73 ArGV 1), accounting and tax obligations.
• Service security: detecting unusual access, backups, logs.
• Relationship with the client company: support, information about the service, subscription invoicing.

The database and documents are hosted in Switzerland, in the Zurich region, by Supabase (Amazon Web Services infrastructure, eu-central-2 region). Supabase’s daily backups stay in the same region; this provider’s technical logs are kept in the European Union. Every night, an additional backup copy is prepared on a temporary GitHub machine (Microsoft Azure infrastructure), encrypted, then stored with Cloudflare (R2) in the European Union: 30 days for daily copies, one year for monthly copies. Once a month, a copy is restored on such a machine to check that it is complete.

The site and the app are served by Cloudflare, which routes the pages and protects the platform against attacks; traffic passes through it encrypted and is not kept beyond technical logs.

Emails sent by the platform (monthly statements, invoices, reminders, account messages) are delivered by Resend, whose servers may be in the European Union or the United States. Only what is needed to send them passes through this service: recipient, subject, message and attachment.

Uploaded files (receipts, documents) are scanned for viruses by Scanii, on its servers in the European Union; the file is not kept there.

The built-in assistant answers from the platform’s help articles: no question is sent to an external artificial intelligence service.

Notifications on your phone or computer, if you turn them on in your profile, go through the notification service of your browser’s or phone’s maker; their content is end-to-end encrypted and that service cannot read it. You can turn them off at any time, device by device.

Sign-in, the demo, the contact form and password changes are protected against bots by Cloudflare Turnstile, which analyses the IP address and technical characteristics of the browser. When a password is chosen, only the first five characters of its hash (never the password) are compared with the public “Pwned Passwords” list of leaked passwords. Messages sent to suite@hencora.ch are hosted by PTisp, in the European Union. Fonts are served by the site itself.

Within a company, access depends on the role: an employee sees their own hours, absences, expenses and documents; a team lead sees the people they approve; the administrator and HR see the whole company; invoicing is only visible to people authorised to invoice. One company’s data is never visible to another.

The Hencora team only accesses a company’s data at that company’s request for support, or when required by law.

• Working time records, absences and monthly statements: five years, in line with the Labour Act.
• Invoices, payments and accounting records: ten years.
• Personnel file documents: for the duration of the employment relationship, then according to the applicable legal periods.
• End of contract: the administrator has 30 days to export the company’s data; it is then deleted within 30 days, except what Hencora must keep by law. Backup copies disappear after 12 months at the latest.

Anyone concerned can request access to their data, its correction, its deletion, its delivery in a common format, or object to processing. The request goes first to their employer, who is the controller; Hencora helps the company respond.

For data Hencora is responsible for, write to suite@hencora.ch. You can also contact the Federal Data Protection and Information Commissioner (FDPIC).

Communications are encrypted (HTTPS). Passwords are stored encrypted and are never visible. Access to data is controlled row by row in the database, according to company and role. Uploaded documents are only accessible to authorised people. Important operations are logged.

The site uses no advertising cookies or third-party trackers. The app stores locally, in the browser, what is needed for the session and display preferences.

To count views and clicks on the ads shown on the site and in the app, a random identifier is stored in the browser. It is hashed before being sent and cannot identify you; it is used for nothing else. It disappears when you clear the site’s data in your browser.