Your payroll data is safe with us.

1. How your data is stored

All WadataHR data - business profiles, worker records, payroll history, contracts, and payslips - is held in an access-controlled database on our cloud servers, with encrypted nightly backups kept for 30 days. Files and backups are encrypted at rest by their providers.

If you need our current hosting region and provider in writing, for a procurement or due-diligence review, email hello@wadatahr.com and we will confirm them.

2. Encryption

In transit: Every connection between your browser and WadataHR uses TLS 1.2 or higher. All connections are HTTPS-only. We enforce HSTS (HTTP Strict Transport Security) so browsers never connect over plain HTTP.

At rest: Files and backups are encrypted at rest by their providers. Database access is restricted to authorised systems and personnel.

Sensitive fields: Particularly sensitive employee data - bank account numbers, PFA PINs, and salary figures - is visible only to authorised roles within the workspace.

3. Tenant isolation

Every WadataHR account is a separate tenant. Every request is scoped to its company with server-side checks, so one business cannot reach another business's records.

4. Access control

Within your account, access is role-based:

• Owner - everything.
• HR Admin - everything except managing owners and admins.
• Manager - hiring and directory, no pay data.
• Employee - own records only.

Every action that changes data - approving payroll, adding a worker, changing pay - is tied to the user who performed it. Data-changing actions are recorded against the user who performed them.

Multi-factor authentication (MFA/TOTP) for owners and HR admins will be available before WadataHR starts paying salaries on your behalf.

5. Authentication

Passwords are hashed using bcrypt - we never store or have access to your plaintext password. Sessions are JWTs that expire after 7 days. Resetting your password invalidates your existing sessions.

We enforce HSTS (HTTP Strict Transport Security) so browsers never connect over plain HTTP.

6. Third-party services

We use a small, vetted set of third-party services. Each one is chosen for their security posture:

• Cloud hosting - the servers that run WadataHR and its database, on a major cloud provider. Sign-in and passwords are handled by WadataHR itself.
• Flutterwave - payment processing for subscriptions. PCI-DSS Level 1 compliant. Card data never touches our servers.
• Resend - transactional email delivery (payslips, alerts). Only the recipient email address and message content (including payslips) are shared.
• Mixpanel - product analytics. Page views (with private links removed) and feature events, plus user ID, company ID, and role when signed in. Always on in the app, on the basis of our legitimate interests. Mixpanel never receives email addresses, payroll figures, bank details, or CV content.
• Anthropic (Claude) - our main AI language-model provider. Candidate CV text, with the job and its must-haves, is sent to Anthropic to generate candidate summaries; CV text never goes to any other AI provider. The role description a founder types, with the company name and state, is sent to Anthropic to draft job posts.
• Groq - backup AI language-model provider for drafting job posts, used only if Anthropic is unavailable. It receives the role description, company name and state. It never receives CV text.
• S3-compatible file storage - CVs, company logos, offer letters, payslips, and employee documents.

7. Error monitoring and logging

Application errors are logged server-side, with access limited to WadataHR engineers. Contact us at hello@wadatahr.com for details.

8. Data retention and deletion

You own your data. Before cancelling, you can download payslips as PDFs and compliance reports as CSVs at any time from your dashboard. For a full export of your data, email hello@wadatahr.com.

When you close your account or ask us to delete your data:

• Personal data is deleted within 90 days unless the law requires us to keep it for longer.
• Payroll and compliance records may be retained for up to 7 years as required by Nigerian tax law.

9. Incident response

If we ever detect a security incident that affects your data, we will notify you promptly by email under the Nigeria Data Protection Act 2023. The notification will tell you what happened, what data was affected, what we are doing about it, and what you should do.

10. Data protection posture

WadataHR operates in compliance with Nigeria's Nigeria Data Protection Act 2023 (NDPA), administered by the Nigeria Data Protection Commission (NDPC). Where data is transferred outside Nigeria, it goes only to our servers in Frankfurt, Germany, and to the named providers above in the United States, with data minimisation and purpose limitation safeguards.

We act as a data processor on behalf of your business (the data controller) for your employees' personal data. Our Privacy Policy and Terms of Service set out the data processing agreement terms.

NDPA 2023 TLS 1.2+ Bcrypt password hashing Tenant isolation