Security at AssistHR
Last updated: 17 August 2026
HR records are sensitive, so we design AssistHR to keep each organisation's data separated, to limit who can see what, and to keep a record of what happened.
This page describes controls that are actually built into the product. We do not claim certifications, audit reports or testing programmes that we have not completed.
Our approach
We keep the platform simple and enforce security as close to the data as possible, rather than relying on the user interface to hide things. That means access rules are applied in the database and on the server, not just in the browser.
No service can be completely secure, and no provider can be fully compliant on your behalf. What we can do is apply sensible controls, be honest about their limits, and fix problems quickly.
Workspace isolation
Each customer has its own workspace. Data access is restricted at the database level using row level security policies, so a request is scoped to the workspace of the signed-in user. This is the main control that keeps one organisation's records separate from another's.
Access controls
Within a workspace, role-based access controls decide what each person can see and do, so a manager, an HR administrator and an employee get different views of the same system.
Roles are stored separately from user profile records. That matters because it means a user cannot gain extra permissions by editing their own profile.
Access to the service is over encrypted HTTPS connections. Internally, access is limited to people whose role requires it, and those people are bound by confidentiality obligations.
Audit logging
Significant actions are recorded in audit logs, so administrators can see what happened and we can investigate if something looks wrong. Audit records also support accountability when an employer needs to demonstrate how a decision or change was made in the system.
Document delivery
Uploaded documents are held in private storage rather than on public URLs. In the normal application workflows, files are delivered through short-lived signed links, so a link cannot be shared indefinitely or guessed.
To be accurate rather than reassuring, one template editor path is still being verified, so we do not claim that every document path in the product uses that model. If you need confirmation for a specific workflow, ask us.
Rate limiting and abuse protection
Sensitive endpoints apply rate limiting, which reduces the impact of automated abuse such as credential-guessing attempts and excessive requests.
Leaked-password checks
When a password is set or changed, we check it against known leaked credential data using a k-anonymity method. Only the first five characters of a SHA-1 hash of the password are sent to the checking service. The full password, the full hash and the user's email address are never sent.
This stops people reusing passwords that are already circulating in breach data, without exposing the password itself.
Data minimisation for AI
The HR Help assistant sends only the sanitised, allowlisted input the feature needs, so whole HR records are not passed to the model. Redaction and minimisation controls are applied before the request leaves the service.
The assistant supports people making decisions. It is not used to make solely automated decisions about employment that have legal or similarly significant effects.
Support diagnostics
If you report a problem, you can choose to send a diagnostic report. It is only sent with your consent and is designed to exclude form values, authentication tokens, cookies, local storage contents and request headers, so troubleshooting information does not carry sensitive content with it.
Export and erasure
The platform includes data export and erasure workflows, so employers can get their records out, respond to individuals exercising their rights, and remove data they no longer need. How this works contractually is set out in our Data Processing Addendum.
Incident response and disclosure
If we become aware of a security incident affecting customer data, we investigate, take steps to contain and fix it, and notify affected customers without undue delay as described in the Data Processing Addendum.
If you believe you have found a vulnerability, please tell us before sharing it publicly. Email info@assisthr.co.uk with enough detail to reproduce the issue. Please do not access, change or delete data belonging to other people, do not run disruptive or high-volume testing against the service, and give us a reasonable opportunity to fix the issue. We will acknowledge your report and keep you updated.