Security
Your staff’s data, handled with rigour.
Hours, salaries, AHV numbers, permits, contracts: what you entrust to Hencora is sensitive. Here is, in concrete terms, how this data is protected, backed up and monitored.
- Hosted in SwitzerlandThe database and documents are kept in the Zurich region.
- Each company on its ownSeparation is enforced in the database itself, row by row, and checked automatically at every change.
- Two-factor authenticationAvailable for every account, mandatory for fiduciaries and the Hencora team.
- Off-site backupsAn encrypted copy every night with a second provider in the European Union, and a restore test every month.
- Scanned filesEvery receipt and document uploaded goes through a virus scan; an infected file is deleted and rejected.
- Everything is loggedHour corrections, views of documents and personnel files, exports and fiduciary actions are recorded in a log that users can neither change nor delete.
If the worst happens, your data is elsewhere too
A backup is only worth something if you know how to restore it. We don’t just make them: we test them.
- 01Every day
A database backup is made automatically at the host, in Switzerland.
- 02Every night
A full copy (database, documents and code) is prepared on a temporary machine, encrypted, then stored with a second provider in the European Union. For its first 7 days, it can be neither changed nor deleted. Daily copies kept for 30 days, monthly copies for one year.
- 03Every month
A copy’s database is restored in a separate environment, then compared table by table with the original; the files are recounted.
Who gets in, and what each person sees
- Passwords
- At least ten characters, with upper and lower case letters, numbers and symbols. Passwords found in known leaks are rejected. They are stored encrypted and no one, not even the Hencora team, can read them.
- Email address
- Every account confirms its address when signing up. A change of address must be confirmed on both the old and the new one.
- Two-factor authentication
- A six-digit code, generated by an app on your phone, in addition to your password. Anyone can turn it on in “My details”.
- Roles
- An employee only sees their own hours, absences and documents. A team lead sees the people they approve. Salaries and confidential documents remain reserved for the administrator and HR.
- Fiduciary
- It has no account in your company. You choose what it sees, it has read-only access, and you can withdraw its access at any time.
- Hencora Team
- It only accesses a company’s data when needed: support request, security incident, necessary maintenance or legal obligation. Administrative access to the platform requires two-factor authentication.
A monitored platform, not just a hosted one
Every change to the platform goes through a series of automatic checks: hour calculation, QR-bills, separation between companies. A failed check is flagged immediately and fixed before going any further.
Platform availability is checked every five minutes; certificates and email configuration, every day. Any outage is reported to us immediately.
When a page hits an error, it is reported to us with the page concerned, without any entered data. We often fix it before anyone writes to us.
Every release is dated and archived. If there is a problem, the previous version can be restored in a few minutes.
Your data stays yours
Nothing is sold, nothing is used for advertising, nothing is used to train artificial intelligence systems. Your company remains responsible for its data; Hencora processes it on the company’s behalf, under a data processing agreement as provided for by the Federal Act on Data Protection (FADP).
You can export everything at any time: PDF statements, hours, salaries, invoices and VAT statement.
Found a vulnerability?
Write to us at suite@hencora.ch describing what you observed. We respond quickly and keep you informed of the fix. Please do not access other people’s data or publish it.
A written procedure governs every incident: assessment, fix, informing the companies concerned.