hachiEmployee records, compensation and feedback deserve careful handling. At hachi, we approach privacy and security as essential responsibilities—not a collection of badges.
Discuss security with usSecurity is not a one-time feature. It requires clear responsibilities, technical safeguards and the discipline to test assumptions. These are the areas that guide our work.
Protecting employee records requires safeguards across application design, infrastructure, data access and operational processes. We review the measures needed to handle confidential information responsibly.
Hachi is designed around distinct employee, manager and HR responsibilities. Access to particularly confidential information, such as compensation and individual evaluations, requires careful authorisation decisions.
Our approach takes account of privacy by design, data minimisation and the roles of customers and service providers. Customer-specific processing arrangements and applicable legal documentation must be agreed before production onboarding.
Application security includes authenticated requests, input validation, access checks, dependency review and testing. We assess safeguards as features and processing requirements evolve.
Operational security calls for monitoring, incident handling, continuity planning and tested recovery arrangements. The scope and availability of service-specific controls can be discussed during technical due diligence.
We welcome customer questions about the technical and organisational measures applicable to their intended use, processing relationships, service providers and data handling. We do not present unverified certifications or assurance claims.
Before onboarding employee information, customers should review relevant security measures, processing terms, service providers and data retention arrangements. We can discuss applicable documentation and the status of individual controls directly.
This page describes our approach and design priorities. It is not a certification, audit report, guarantee of any particular control, or statement that a GDPR compliance assessment has been completed.