Security built around workforce data.
Employee, payroll and HR information needs stronger controls than a normal business app. Milo's People uses layered access controls, private storage, encryption and auditability to reduce that risk.
Tenant separation
Tenant-aware server checks and row-level database policies restrict access to records belonging to the authorised user, company and role.
Authentication
Authenticated platform access uses Supabase Auth. Privileged sensitive-data reveal is designed to require an MFA-backed AAL2 session.
Least-privilege roles
Permissions separate profile, payroll, bank, compensation, rota and administrative capabilities so access can be limited to the job that requires it.
Sensitive HR information
Dedicated National Insurance and bank fields are encrypted with a project-specific key held outside source control. Full values are available only to authorised roles with MFA-backed access.
Private document storage
Employee and company document buckets are private. Access is governed through authenticated, tenant-aware storage rules rather than public bucket URLs.
Audit logging
Sensitive profile updates, pay changes and full sensitive-value reveals are recorded with actor, target, action and timestamp. Secret values are not placed in the audit details.
Payroll confidentiality
Pay-rate history is not company-wide data. Employees can access their own authorised data, while payroll and compensation access requires the relevant permission.
Kiosk protections
Clocking PINs are one-way hashed, device credentials are stored as hashes, activation is token based, and repeated invalid attempts can trigger temporary lockout.
Incident response
We maintain a personal-data-breach and security-incident process, including prompt customer notification where we act as processor and regulatory assessment by the controller.
Privacy and security contact
Customers can request our security/compliance information or raise a privacy concern using the contact route below.
Need due-diligence information?
Request our security overview, privacy information or data-processing documentation.
Request security informationReady to simplify your people operation?
Bring rotas, HR, attendance, documents and payroll preparation together in one friendly place.
