Security Policy

Truesant handles sensitive employment and payroll data on behalf of thousands of workers and organisations. We treat security as a fundamental responsibility, not a feature. This page describes our security programme, control environment, and how to report vulnerabilities.

• Encryption at rest — all data is encrypted at rest using industry-standard algorithms. Sensitive identifiers (national identity numbers, bank details) receive an additional application-level encryption layer and are never returned to the browser in unmasked form.
• Encryption in transit — all communications use HTTPS/TLS. We enforce strong cipher suites and reject obsolete protocol versions.
• Data residency — customer data is stored and processed within the European Union. We do not route data through regions outside the EU without your explicit consent and appropriate safeguards.

• Multi-tenant isolation — every tenant's data is logically isolated at the database level. No query or API call can access another tenant's records, enforced by server-side policies.
• Role-based access control (RBAC) — 9 distinct roles with granular permissions. Access to sensitive functions is gated on both the server (API) and client (UI).
• Multi-factor authentication — MFA is currently being rolled out, starting with platform staff and tenant administrators. Until it is generally available we enforce strong password requirements and short-lived, single-use links for account activation and password resets.
• Identity verification — service partners are onboarded with verified identity checks using leading eID and identity verification services.
• Least privilege — internal staff and automated systems receive the minimum access required for their function. Admin-level database credentials are never exposed to application code.

• Cloud infrastructure — we use enterprise-grade cloud infrastructure with SOC 2 Type II and ISO 27001 certifications.
• Automatic backups — database backups are taken daily with point-in-time recovery. Backup integrity is tested regularly.
• Dependency management — we monitor for known vulnerabilities in third-party dependencies and apply patches promptly.
• Security monitoring — we maintain centralised logging and alerting for suspicious activity, authentication failures, and anomalous API usage.
• Network controls — administrative interfaces are not publicly accessible. API endpoints are rate-limited and monitored for abuse.

• Secure development lifecycle — security reviews are part of our code review process. We use static analysis tools and dependency scanning in our CI pipeline.
• Input validation — all user input is validated and sanitised on the server. Parameterised queries are used throughout to prevent injection attacks.
• OWASP Top 10 — our security posture is designed to address the OWASP Top 10 web application security risks.
• API security — all API endpoints require authenticated, role-scoped JWTs. Tokens have short expiry windows and are issued with minimal scope.

Our security programme is aligned with:

• GDPR and applicable national data protection laws.
• PCI-DSS requirements relevant to our payment data handling scope.
• Swedish and EU employment data regulations.
• Applicable labour law requirements in each jurisdiction we operate in.

For GDPR-specific information, see our GDPR page.

We maintain an incident response plan covering detection, containment, eradication, recovery, and post-incident review. In the event of a security incident affecting personal data, we follow our breach notification obligations under GDPR — notifying the relevant supervisory authority within 72 hours and affected individuals without undue delay where required.

We take all security reports seriously. If you believe you have discovered a vulnerability in the Truesant platform, please report it responsibly:

We ask that you:

• Do not access or modify data belonging to other users.
• Do not perform denial-of-service attacks or disrupt live services.
• Give us reasonable time to investigate and remediate before public disclosure.

We will acknowledge your report within 2 business days and aim to resolve confirmed vulnerabilities within 30 days. We do not pursue legal action against researchers acting in good faith under this policy.

Security enquiries: security@truesant.com. For general questions, use our contact page.