Security Practices

We take the security of your data seriously. Below are the technical and organizational measures we maintain. While no system is 100% secure, we are committed to industry-standard protections appropriate for a SaaS application handling compensation data.

14.1 Encryption

• All data encrypted in transit using TLS 1.2+.
• Data encrypted at rest using AES-256.
• Passwords hashed with bcrypt (salted, high work factor).
• Authentication tokens secured via signed, short-lived JWTs.

14.2 Access Control

• Role-based access control (Admin, Manager, Rep) within each organization.
• Organization-scoped data isolation — no cross-tenant data access by design.
• Session management with automatic expiration.

14.3 Infrastructure

• Hosted on enterprise-grade cloud infrastructure with SOC 2 certified providers.
• Point-in-time recovery for database backups.
• DDoS protection and web application firewalls.
• Environment isolation (development, staging, production).

14.4 Application Security

• Input validation and parameterized queries to prevent injection attacks.
• CSRF protection enforced on all state-changing operations.
• Content Security Policy headers enforced.
• Regular dependency auditing and vulnerability scanning.

14.5 Incident Response

• We maintain documented incident response procedures.
• We will notify affected users of confirmed security breaches impacting their data without unreasonable delay and in accordance with applicable law.
• Post-incident reviews and root cause analysis are conducted for all security events.

14.6 Vulnerability Reporting

If you discover a security vulnerability, please report it responsibly to security@earnestcomp.com. We will acknowledge receipt within 48 hours. Please do not publicly disclose vulnerabilities until we have had a reasonable opportunity to address them.