Aajar Attendance App
Log inSign up free

Security Overview

Aajar Attendance App · Last updated

Attendance and payroll data must be protected. This page describes what we actually do. We do not claim certifications we do not hold.

1. Keeping organizations apart

Every organization's data is separate. Each request is checked against the signed-in person's organization and role on the server, not just in the app, so one organization cannot read or change another's records. Inside an organization, the Owner, Admin, HR and Employee roles decide who can see salaries, approve requests or change settings, and an organization's plan decides which features are available.

2. Accounts and sign-in

  • Passwords are never stored as text. Only a salted, one-way hash is kept, and it is upgraded automatically as standards improve. New passwords must be at least 8 characters, cannot be one of the most-used passwords or a simple sequence, and must mix letters with numbers or symbols (or be 12 characters or longer).
  • Guessing is slowed down and stopped. After several wrong passwords an account is locked for a short time, whether or not the email address has an account, and a network address that tries many accounts is paused. The wrong-code limit on two-step verification works the same way. The account holder is emailed when a lock happens, and an Owner or Admin can unlock the person.
  • New accounts are asked to verify their email address. Password-reset links are single-use, expire after 60 minutes, are stored only as a hash, and are rate-limited. Resetting a password signs the account out everywhere.
  • Two-step verification is available to every user, with an authenticator app (recommended) or an emailed code, plus one-time backup codes. Owners and Admins can require it for admins or for everyone. The authenticator secrets are stored encrypted.
  • Sign-in tokens are long random values, and only a one-way hash of each is stored, so a copy of the database cannot be used to sign in. A sign-in ends after 30 days, or after 14 days without use, and at most 10 devices stay signed in. Signing out removes the token, changing a password signs out the other devices, and anyone can sign out of every device from Account → Security.
  • Owners can control who has access, and employees who leave can be removed.

3. Protecting data in transit and at rest

  • The site and the app are served over HTTPS, plain HTTP requests are redirected to HTTPS, and browsers are told to use HTTPS only for this site (HSTS). A content security policy limits what a page can load or send data to, and the site cannot be shown inside another site's frame.
  • Uploaded documents and expense receipts are stored in folders that the web server will not serve directly. They are delivered only through the app after a permission check.
  • Uploads are checked by their contents, not their file name: only PDF, PNG, JPEG and WebP files are accepted, with size limits, and each is saved under a random name. Upload folders are set so that nothing in them can ever run as a program.
  • Card and bank-account numbers never reach our servers; payments are made on the payment provider's own page.
  • Database access is limited to the application, and secrets such as database passwords and payment keys are kept in server-side configuration, not in the web pages.

4. Accountability

  • Manual changes to attendance records are marked as such and recorded with who changed them and what the earlier values were.
  • Billing events (invoices, payments, confirmations) are logged.
  • A security log records sign-ins, wrong passwords, lockouts, password and two-step changes, and role and administrator changes, with the time and network address. Owners and Admins can read it for their own organization; it is kept for a year. Platform administrators are emailed about suspicious events such as a locked administrator login or a new administrator being added.
  • Deleting an organization requires a platform administrator to type the organization's name, and removes its data permanently (see the Privacy Policy).

5. Biometric and location data

Aajar does not receive or store fingerprint or face templates; biometric terminals only send punch records (device user ID, time and type). Location is read from the device only when someone checks in or out with geofencing turned on, and no background tracking takes place.

6. Our infrastructure

Aajar is hosted with a third-party hosting provider, which is responsible for the physical security of its data centres and servers. We keep the software up to date and look into problems promptly when they are reported.

7. Your part

Security is shared. Please use strong, unique passwords, do not share logins, remove access for people who leave, give roles only to those who need them, and keep your own phones, computers and biometric devices secure.

8. Reporting a vulnerability or incident

If you find a security problem or suspect your account has been misused, tell us right away through the Help & contact form and begin the message with “Security”. Give enough detail for us to reproduce it, and do not access other people's data or disrupt the service while testing. We will acknowledge your report, look into it, and keep you informed. If a breach affects personal data we will notify the organizations concerned as set out in the Data Processing Addendum.