How your data is protected

Selected fields are encrypted #

Employee and user name/contact values are encrypted with AES-256-GCM using a fresh data-encryption key per record. The data key is wrapped and unwrapped through Google Cloud KMS; the encrypted field values and wrapped key are stored with the record. This is field-level protection, not a claim that every database field or every stored file is encrypted in the same way.

The KMS integration depends on deployment credentials and configuration. Access to decrypted values occurs in application code when an authorized workflow needs them.

Access and audit controls #

API routes generally scope records to an organization. Manager employee queries are further limited to the manager's linked employee and direct reports; invalid links fail closed. Some sensitive actions, including exports and deletions, create audit events. Sign-in sessions and TOTP checks are also implemented.

These controls should not be confused with independent security certification, a penetration-test claim, or a guarantee that no authorized user can access personal data. [CONFIRM: current independent security certifications and audit status]

• Employee name and contact fields use field-level encryption.
• Protected APIs apply organization and role-based access checks.
• Some sensitive operations, including exports and deletions, create audit events.

External services and storage #

Audio transcription, image text extraction, language-model analysis, email, WhatsApp, and encryption can involve separately configured services. The code selects providers from application configuration, but the applicable provider, region, retention, and use-of-data terms may vary by deployment.

Provider data-processing terms, retention periods, and the production provider configuration are not verified by this code review. [CONFIRM: deployed AI, speech, OCR, storage providers and their data policies]