Loading
Security
A tenant boundary enforced by remembering to add a filter is a boundary that holds until the first busy afternoon. OneclickHR puts it in Postgres, on every table, and tests it against a real database.
How it works
Security pages are usually a list of adjectives. These are mechanisms, and each one is either true of the system or it is not.
The tenant boundary is a Postgres policy, not a filter somebody has to remember to add.
A mocked isolation test proves only that the mock agrees with its author.
Access is re-checked from the database on every request, not trusted from a token.
We check the bytes as stored, not what the browser claimed during the upload.
Integration tokens are encrypted with AES-256, and a bad key stops the service.
A durable record of mutations, so "what changed and when" has an answer.
Every run records its outcome, so a silent breakage is not possible.
Four role types, granular team roles, and presets so they get assigned correctly.
Infrastructure
We say this plainly because it is a credibility asset rather than something to be vague about. There is no analytics vendor, no advertising network and no session recorder, because each would be another company holding employee data to no clear benefit.
The complete list, including the optional Google integrations and what each provider processes, is on the subprocessors page.
Honesty
Software that claims certifications it does not hold has told you something useful about everything else it claims. So here is both columns.
The architecture was built with data isolation and least privilege as first principles, and the data residency region is chosen per deployment. We offer a data processing addendum, we name every subprocessor and what it processes, and we will answer a security questionnaire honestly, including where the answer is no. If a certification is a hard requirement for you today, we would rather tell you now than six weeks into a procurement process.
Disclosure
If you find a security issue, we would much rather hear from you than not. Email security@oneclickhr.app with enough detail to reproduce it. We will not pursue you for good-faith research that avoids privacy violations, data destruction and service disruption. Because we are a small team, the person who reads your report has read the code.
Send us your security questionnaire, or just the three questions you actually care about. We will answer specifically, including where the answer is no.