Security and data protection

Access and separation

• Company-scoped records and explicit tenant checks for sensitive workflows
• Role and permission controls for administrative, HR, payroll, management and cashier tasks
• Authenticated access to private business pages
• Short-lived or shift-bound tokens for public companion workflows such as POS phone scanning

Application safeguards

• Encrypted HTTPS connections
• Password hashing and framework authentication controls
• CSRF protection, request validation and rate limiting
• Server-side payment verification and idempotency protection
• Backups and recoverable deployment practices

Customer responsibilities

Companies must assign access carefully, remove access when roles change, use strong unique passwords, protect devices, verify exported data recipients and report suspected compromise promptly. No system can guarantee absolute security.

Zambia data-protection context

PeopleVanta is designed with the collection, use, storage, transmission and protection of personal data in mind. Each customer must also assess its own obligations as an employer and data controller under applicable Zambian law.