Security
What we do, stated plainly.
How GrowthPPL keeps one workspace's data apart from another's, who can get in, what we encrypt, and what we don't have yet.
Data isolation
- Row-level security, enforced in production. Every workspace's rows are separated by Postgres row-level security. The application connects under a restricted database role that cannot bypass it.
- Scoped queries on top. Every query is also scoped to the signed-in person's workspace in the application code.
Access
- Two-factor sign-in by role. Codes from an authenticator app (TOTP), which the owner can require for the roles they choose.
- Google or Microsoft sign-in (OIDC). Matched to a login you have invited, by its verified address. It never creates an account.
- Logins that see only their part. Roles and custom roles decide what each login can do; an HR login can be limited to a company, a site or a department, and payroll figures sit behind their own permission.
- Support access only by your grant. Our team enters a workspace only while its owner's grant is open.
- Passwords and links. Passwords are hashed with bcrypt. Invite and password-reset links are single-use and stored as hashes.
Demo workspace · fictional clinic group
Sensitive data
- Identity numbers are encrypted at rest. PAN, UAN, bank account, statutory scheme and identity document numbers are sealed with AES-256-GCM. Screens show the last four characters.
- Keys that can be rotated. A new encryption key re-seals every stored value; the old key is retired once nothing needs it.
- PAN masked on payslips. The payslip masks the PAN by default.
- The assistant withholds what it doesn't need. From your records, the assistant never sends ID numbers, bank details or salaries to the AI provider, nor the cells of a sheet you attach; ID numbers you type are removed before sending.
Your data, your exit
- Owner ZIP archive. The workspace owner can download the whole workspace as a ZIP archive at any time.
- Erasure. A former employee's personal data can be erased, while the pay and tax records the law makes you keep stay.
- Soft deletes. Deleted records are recoverable for a window before they are purged.
- Audit log. Who changed what, and when.
Demo workspace · fictional clinic group
AI and your data
- Your choice of model. Runs on Anthropic, OpenAI, Google or xAI models, on our key or your own.
- It asks first. The assistant plans, shows a preview and waits for your confirmation. It runs as you, with your permissions, and cannot run payroll or send an offer.
Hosting and integrations
- Hosted in Singapore. The database runs on Neon (ap-southeast-1) and the application on Vercel's Singapore region. Traffic is served over TLS.
- Signed webhooks. Outbound webhooks are signed with HMAC-SHA256, so your receiver can check each one came from us.
- Scoped API keys. Each REST API key is named and limited to the scopes you give it.
Reporting a vulnerability
Email security@growthppl.com. We'll acknowledge your report and work with you in good faith.
In scope: the GrowthPPL application, its API and this website. Please don't access data that isn't yours, run load tests, disrupt the service or contact our customers.
The full list of what's in the product today is on what's included today. Security questions: contact us.
Bring your security questions.
We'll walk you through any of this on the demo workspace.