Skip to content
Zetta HR
Try it free
FeaturesSponsor compliancePricingSign in

Security overview

Last updated 2026-10-22. Draft: pending review by a qualified lawyer.

Zetta HR holds sensitive HR and immigration-related records, so security is designed in. This page describes the measures in place today. It is a description, not a certification: we do not currently hold ISO 27001 or SOC 2 reports, though several of our infrastructure providers do.

Separation of customers

  • Every organisation’s data is isolated by database row-level security rules enforced by the database itself, not only by the application.
  • Permissions are role-based (for example owner, HR, manager, employee). Salary and other private fields are excluded from general reports.
  • Billing limits and plan entitlements are enforced in the database.

Data protection

  • All traffic uses HTTPS (TLS). Strict transport security and standard browser security headers are set.
  • Data is encrypted at rest by our database and storage providers.
  • Documents are stored in private storage and served only through permission-checked requests; there are no public file links.
  • Passwords are never stored by us in readable form; authentication is handled by Supabase Auth.
  • Database in the UK (London); document storage in the EU.

Application and operations

  • Sensitive actions and exports are written to an append-only audit log.
  • Rate limiting protects sign-in and API endpoints.
  • Secrets are held in the hosting platform’s secret store, never in source code.
  • Code changes pass automated type checks, unit tests and a database security test suite (including cross-organisation isolation tests) before release.
  • Database backups are taken by our database provider.
  • Production access is limited to named administrators.

Incidents

We have an incident response procedure. We notify affected customers of a personal data breach without undue delay and within the timescale in our DPA, and the ICO within 72 hours where required.

Reporting a vulnerability

Please email support@zettahr.com with details. Give us reasonable time to fix an issue before disclosing it, and do not access other people’s data or disrupt the service. We will acknowledge reports and keep you informed.