Trust
You are handing us records you are legally required to keep. That deserves specifics.
Details of the technical and organisational controls used to protect customer records.
How the data is protected.
| Control | What it means |
|---|---|
| Separation between customers | Enforced in the database itself, not only in application code, so a programming mistake cannot expose another organisation’s records. |
| Encryption at rest, per person | Documents are encrypted with a key held per individual, which is what makes erasing one person genuinely possible later. |
| Every access recorded | Viewing a document is an event in an append-only log, including when we do it. |
| The log cannot be quietly rewritten | Entries are chained, and the chain is verified every night. Each verification is itself recorded in the log, so a break would show. The log holds IDs, never personal details. |
| Files scanned and stripped | Uploads are scanned, image metadata is removed, and files are served in a way that cannot execute in your browser. |
| Two-step sign-in | Owners and Administrators set it up within 14 days, and approving the deletion of records requires it. |
| Backups tested by restoring them | A backup that has never been restored is a belief, not a backup. |
Sub-processors.
Named, with the country each operates in. Both backup and hosting locations are listed — a supplier that mentions only one of those is not telling you everything.
| Who | What for | Where |
|---|---|---|
| Hetzner | Servers and storage | Germany |
| Hetzner Storage Box | Off-site backups | Finland |
| Zoho | Sending email | European Union |
For security and procurement teams.
If you are reviewing Stamped HR for your organisation, write to enquiries@stampedhr.com. We will send the data processing agreement, the sub-processor list with each country, and written answers to your security questionnaire.
We can put your security or data protection lead on the same call as the demo, or speak to them separately. Ask for anything you need to see before you commit.
Your data protection position.
For the records you keep in Stamped HR, you are the controller and we are the processor. A signable data processing agreement is available before you commit to anything, not after.
We are the controller for our own account, billing and security records, and we say so rather than describing the whole relationship as one thing.
Retention is driven by rules rather than by someone remembering to delete. Nothing is deleted while a hold is in place, disposal produces a documented decision, and erasing a person works by destroying their key — which is what makes it effective even in backups that cannot be selectively rewritten.
Questions.
Where is the data held?
Who can see our records?
What happens if you are unavailable?
Send us your security questionnaire.
We would rather answer it early than discover halfway through a procurement that we cannot.