Security & compliance
Your people data deserves more than a password
HR systems hold salaries, identity documents and medical certificates. Here is exactly how Mawro protects them.
Identity and sessions
- Passwords are hashed with bcrypt and never stored in plain text. Sign-ins for unknown accounts take the same path, so the response does not reveal who has an account.
- Short-lived access tokens (one hour by default) and refresh tokens that rotate on every use. Reusing an old refresh token revokes all of that user's sessions; signing out revokes the session.
- Rate limiting on sign-in, plus a request limit across the API.
- Emailed sign-in codes are burned after five wrong attempts, and the number of codes sent is capped.
- Privileged permissions require the user to re-enter their password before acting.
- A PIN lock for the portal on shared devices, and PIN or biometric unlock for the mobile app.
Sign-in protection
- Two-step verification with authenticator-app codes (TOTP) and ten single-use recovery codes. A company can require it for administrators or for everyone.
- Accounts lock after repeated wrong passwords or codes; the person is emailed, and an administrator can unlock them, with the unlock audited.
- A password policy per company: length, symbols, no reuse of recent passwords and a maximum age.
- Password reset by a single-use link that expires in 30 minutes; changing a password signs out every other session.
- Everyone can see their active sessions and recent sign-ins, end any session or all the others, and is emailed when a new device signs in.
Access control
- One decision point for every permission, checking in order: tenant boundary, explicit denies, data scope (self, team, organisation) and segregation of duties.
- Field-level permissions and masking: salary, identity numbers and other sensitive fields are shown only to people who may see them.
- Segregation-of-duties rules stop conflicting permissions being combined, such as preparing and approving payroll.
- An access profile explainer shows where each of a user's permissions comes from.
- The AI assistant acts with the asking user's own permissions and has no direct route to the database.
Workspace isolation and integrations
- Every request is bound to one workspace, and a guard at the database layer scopes every query to that workspace, so one company's data cannot be read or written from another.
- Support access to your workspace needs your administrator's approval, and is read-only, time-boxed and logged.
- API keys are shown once and stored hashed, limited to chosen scopes and to their creator's own permissions, rate-limited per key, and every call is audited.
- Webhooks are signed with HMAC-SHA256, their secrets are encrypted, and they are only sent to public https addresses.
- With masking on (the default), the AI assistant removes identity numbers, bank account numbers, phone numbers, email addresses and pay amounts before any text goes to the model provider.
Maker-checker and audit
- More than sixty workflows block self-approval, including through a delegate, and a material change restarts the approval chain.
- If no eligible approver can be found, nothing is approved automatically.
- An append-only audit trail records the action, the record, old and new values per field (sensitive values masked), the reason and the channel.
- Granting access is itself a maker-checker workflow.
Data and encryption
- Traffic is encrypted with HTTPS, with certificates renewed automatically.
- Identity document numbers, mail server passwords and other credentials are encrypted in the database with AES-256-GCM, using keys that can be rotated.
- Documents and files are stored in the database itself, so one backup holds everything.
- Automated daily database backups in the SaaS service; private-cloud and on-premise customers apply their own policy.
- HTTP security headers on the API.
Certified and audited
Independent certification and audit, and a data protection programme behind every deployment.
- ISO/IEC 27001Certified information security management system.
- SOC 2 Type IIIndependent audit of our security controls over time.
- GDPRData protection programme with a data processing agreement for every customer.
Certificates and the SOC 2 report are shared with customers under NDA on request.
Deploy it your way
- SaaSFully managed by us. Sign in and start.
- Private cloudA dedicated instance in your own cloud account.
- On-premiseInstalled on your own servers, inside your network.
Your data, your documents
You can export employee data to Excel or CSV at any time. Our data processing agreement sets out how we process personal data on your behalf. Data processing agreement
Security questions
Where does our data live?
Where you choose: in the Mawro cloud service (SaaS), in a private cloud, or on your own servers on-premise. Talk to us about data residency requirements.
Is Mawro certified?
Yes. Mawro is ISO/IEC 27001 certified, has a SOC 2 Type II report and runs a GDPR compliance programme. The controls on this page, from field-level permissions and segregation of duties to the audit trail, encryption and data export, support your obligations under data protection law and your internal and external audits. We share the details with customers' security teams on request.
How do you protect sign-in?
Hashed passwords with account lockout, optional or required two-step verification with an authenticator app, a password policy you set, short-lived sessions that rotate on every use, and password re-entry before sensitive actions. The mobile app uses an emailed code followed by a device PIN or biometrics.
Do you use our data to train AI models?
We do not use customer data to train models. When enabled, the AI assistant acts with the user's permissions and sends the model provider only what is needed to answer the question.
How do we report a vulnerability?
Email security@mawro.com. We welcome responsible disclosure and reply to every report.
Need our security pack for your review?
Book a call with our team and bring your security questionnaire.