Security & trust
What the platform does to protect HR data
This page lists only controls that exist in the Ergenza code today. Where something is still being built, we say so.
Isolation
Your company’s data stays separate
The database keeps companies apart
The database itself only returns your company’s rows (PostgreSQL row-level security, enabled and forced). This protection does not rely on our application code alone.
Links never cross companies
Every link between records includes your company, so a record cannot point to another company’s data.
Accountability
A change history that shows tampering
Change records that cannot be rewritten
Each company’s change records are numbered and linked by a fingerprint (a SHA-256 hash). The database refuses edits and deletes, and any altered entry breaks the chain.
Safe webhooks
Before Ergenza sends an event to another system (a webhook), it checks the address so it cannot reach private internal networks.
Encryption
Sensitive data is encrypted by the application
Field-level encryption
Sensitive fields are encrypted with AES-256 before they are written to the database.
Protected integration secrets
Passwords and keys for your connected tools are stored with authenticated encryption (AES-GCM), so they cannot be read or quietly changed.
Privacy
Export or erase a person’s data
Export
An administrator requests an export for a person. It runs in the background, and the file is encrypted (AES-256) with a key shown once to the requester.
Erasure
Erasure requests follow the same tracked process, so every request has a status and a record.
Self-service privacy requests by employees are not yet enabled; requests are filed by an administrator.
Access
Sign-in and session controls
Passkeys
Passkey-first sign-in, with secure remember-me sessions.
SSO and SCIM
Single sign-on through OpenID Connect (SAML 2.0 on the roadmap), and automatic user setup (SCIM).
Your sign-in rules
Password rules and history, lockout after repeated failures, and session and idle timeouts.
Status
What we do not claim
Ergenza is in early access. We do not currently hold SOC 2, ISO 27001 or other third-party certifications, and we do not publish uptime figures yet. If you find a security issue, please email security@ergenza.com.
See Ergenza on your own data
In active development — sign-ups are locked for now. When sign-ups open, paid plans include a 30-day free trial with no card, and every workspace is set up by hand.