HR data is the most sensitive data most businesses hold: ID numbers, salaries, disciplinary records, medical absence. This page sets out how Innovace is built to protect it, in plain language and without marketing gloss. Everything described here is live in the platform today, and we are happy to walk your IT or legal team through any of it.
Security overview
Security is handled at the application layer where it belongs, in code that ships with the platform rather than in host configuration that can drift.
Tenant isolation. Every customer gets their own separate database. The lookup that maps a workspace to its database fails closed: an unknown or suspended workspace is refused outright and never falls back to another customer's data.
Enforced HTTPS. HTTP Strict Transport Security is sent on every response with a one-year lifetime covering all workspace subdomains, so browsers refuse to connect over plain HTTP.
Brute-force protection. Sign-in attempts are rate limited per IP address, and repeated failures are locked out for a cooling-off period.
Session hardening. Session cookies are HTTP-only, secure and SameSite-restricted, and the session identifier is regenerated the moment you sign in, which closes off session fixation.
Browser-level protections. Clickjacking, MIME-sniffing, injected base tags and off-site form posting are all blocked by response headers set on every page, not only on static files.
Forged-header defence. Client IP addresses recorded in the audit trail are only taken from proxy headers when the connection genuinely originates from our CDN, so a logged IP cannot be spoofed.
Data hosting location
Innovace runs on a dedicated server in a South African data centre. Your employee records, payroll data and uploaded documents stay in the country.
Local hosting means local latency: the platform is fast for South African users rather than fast for someone else's users.
Keeping personal information in South Africa avoids the cross-border transfer questions that offshore platforms have to answer under POPIA.
A small number of supporting services, notably email delivery through Google, process data outside South Africa. Where that happens we require an adequate level of protection, as POPIA expects. Our Privacy Policy sets this out in full.
Encryption
Traffic between your browser and Innovace is encrypted end to end, and credentials are never recoverable, not even by us.
In transit. Every connection uses HTTPS with TLS. Plain HTTP is refused rather than redirected, for the whole platform and every workspace subdomain.
Passwords. Stored as bcrypt hashes with a per-password salt. We cannot read your password, and a database copy would not reveal it. Nobody at Innovace can tell you what your password is, only reset it.
API access. Integration keys are stored hashed, carry only the specific scopes you grant them, and are individually rate limited and revocable.
Roles and permission controls
Access is granted by role, and roles are yours to shape. Nobody sees a module, a screen or a button they have not been given.
Fully customisable roles. Start from a catalogue of ready-made roles covering the usual HR, payroll, line-manager and employee patterns, then change them, or build your own from scratch.
Granular permissions. Rights are set per action, not per module, so viewing, adding, editing and deleting are separate decisions. A manager can be allowed to view attendance without being able to change it.
Enforced server-side. Permissions are checked on the request, not just in the interface. Hiding a menu item is a convenience; the check that matters happens before any data is returned.
Protected administrator role. The super administrator role cannot be deleted or stripped of its rights, so a workspace can never be locked out of its own account.
Optional IP restriction. Sign-in can be limited to your office IP ranges where your policy requires it.
Audit logging
Changes to people data are recorded as a matter of course, which is what turns "we think that was corrected in March" into evidence.
Before and after. Record changes are logged with both the previous and the new values, alongside who made the change, from where, and when.
Security events too. Failed sign-ins, permission denials and settings changes are recorded separately from data changes, so an investigation does not have to sift through routine edits.
Written in the application. Audit entries are written by the code performing the change rather than by database triggers, which keeps the logic visible, testable and in one place.
Useful well beyond security: disciplinary matters, CCMA disputes and payroll queries all turn on being able to show exactly what changed and when.
Backups and your data
Server-level backups are run by our hosting provider as part of the dedicated server arrangement, and cover the application and its databases.
These are operational backups: they exist so the service can be restored after an infrastructure failure, and we will always tell you honestly what can and cannot be recovered rather than promise a restore we have not tested.
Your data stays portable. The main registers, including employees, attendance, payroll and recruitment, export to CSV, and our REST API lets you pull your data on your own schedule. We would rather you hold your own copy than rely on ours.
No lock-in. Your data is yours. If you leave, you can take a full export with you.
If your organisation has a specific retention or recovery-time requirement, raise it with us before you sign and we will tell you plainly whether we can meet it.
Support arrangements
You deal with the people who build the platform. There is no offshore first line reading from a script.
Hours. Monday to Friday, 08:00 – 17:00 SAST, South African public holidays excluded.
How to reach us. Email sales@innovace.co.za. We aim to respond within one business day.
Onboarding. New workspaces are set up with you, not handed over with a login and a link to the manual.
Security questions. If your IT or compliance team needs detail beyond this page, ask and we will answer directly.
Privacy and POPIA
Innovace is designed with POPIA principles in mind, and the roles are set out clearly so there is no confusion about who is accountable for what.
You remain in control. For the employee data you put into Innovace, your organisation is the Responsible Party and Innovace is your Operator. We process it on your instructions and never for our own purposes.
Consent where it is needed. The public-facing forms, job applications and referrals capture explicit consent before collecting personal information.
Special personal information. Fields such as race and disability status, needed for Employment Equity reporting, are recognised as special personal information and handled accordingly.
Read the detail in our Privacy Policy, or see how to make a records request under PAIA.
Need more detail?
Security questionnaires, vendor assessments and due-diligence packs are part of the job, not an imposition. Send yours through and we will complete it properly.
