Trust
Security
Personnel files hold salaries, social security numbers and medical certificates. This page says how they are protected and what is still missing.
- Switzerland, Zurich
- TLS and AES-256
- Tenant-based data rules
- In the database
- Security and HR actions
How the protection is built
Permissions live in the database
Every query runs under the session of the signed-in person and the database decides row by row what is visible. Calling an address directly or guessing an identifier returns nothing you are not entitled to. An interface that hides a button is not access control.
Encrypted in transit and at rest
Every connection runs over TLS, data on disk is encrypted with AES-256. Documents sit in storage with no public access and are served only through short-lived signed URLs that the server issues after the permission check.
Traceable actions
Who opened a payslip, downloaded a document, changed a role or shared a review stays traceable with a timestamp. The log can be exported, for your audit and for a supervisory authority.
Swiss and European data protection law
Permissions, logs and export tools support your privacy processes. A draft data processing agreement is available. Meeting legal requirements also depends on your configuration, processes and contracts.
The database separates tenants
Every row carries its tenant and every policy checks it. A cross-tenant access is not a case the application catches, it is one the database refuses. This is verified on every test run with real queries across two tenants.
What we do not do
- We do not sell data and pass none to third parties, other than the providers needed to run the service.
- We run no advertising and set no tracking cookies. The website uses only technically necessary cookies.
- We do not train AI models on your data.
- We do not look at your personnel data. Support needs a time-limited grant that you give in the settings and can withdraw at any time.
What is still missing
Sign-in supports a second factor and passkeys. An external penetration test and Swissdec certification for electronic salary declarations are still outstanding. The product and pricing pages describe the functions that are available today.
Report a vulnerability
If you find a weakness, write to us with the subject Security. We answer within a working day and come back to you once it is fixed.
Get to know Rewalz.
Rewalz is not open to everyone yet. Sign up and we will get in touch as soon as your access is ready.