Security at HR Partner
Learn about HR Partner’s approach to protecting customer data, securing infrastructure, and maintaining a reliable, trusted service.
At HR Partner, protecting customer data is a core part of how we design, build, and operate our platform. We use a combination of secure infrastructure, access controls, encryption, monitoring, and operational processes to help safeguard the confidentiality, integrity, and availability of customer data.
Infrastructure & Hosting
HR Partner is hosted using Amazon Web Services (AWS), one of the world’s leading cloud infrastructure providers.
AWS maintains a broad range of internationally recognized security and compliance certifications, including ISO 27001, SOC 1, SOC 2, SOC 3, and PCI DSS, as well as resources that support GDPR-aligned deployments. These certifications apply to AWS infrastructure and support HR Partner’s secure hosting environment.
Our infrastructure is designed with security, reliability, and availability in mind, including:
- Redundant infrastructure and cloud-based resilience
- Infrastructure monitoring and alerting
- Firewall and network-level protections
- DDoS monitoring and mitigation
- Ongoing system maintenance and updates
Encryption & Data Protection
HR Partner uses encryption and other technical safeguards to help protect customer data.
This includes:
- Encryption of data in transit using HTTPS/TLS
- Encryption of data at rest
- Secure password hashing and salting
- Secure authentication and access controls
Customer payment information is processed by secure PCI-compliant payment providers. HR Partner does not store full payment card details on its own systems.
Account Security
HR Partner provides account-level security controls to help customers manage access to their data, including secure authentication, role-based permissions, and user access management. Multi-factor authentication is available to help customers add an additional layer of account protection.
Customers are responsible for managing their own user access and removing users who no longer require access.
Access Controls & Internal Security
Access to customer data within HR Partner is restricted to authorized personnel who require access to perform their duties.
Employees and contractors with elevated system access are subject to confidentiality obligations and internal access controls. Access is reviewed and removed where no longer required.
Where customer support access is required, HR Partner aims to access customer accounts only where reasonably necessary to provide requested support or troubleshooting assistance.
Monitoring & Vulnerability Management
HR Partner uses monitoring and alerting systems to help identify unusual activity, infrastructure issues, and potential service disruptions.
We also maintain processes for:
- Ongoing patching and software updates
- Reviewing security advisories and vulnerabilities
- Monitoring third-party libraries and dependencies
- Investigating and responding to security-related events
Backups, Recovery & Business Continuity
Customer data is backed up regularly to support operational resilience and recovery processes.
Backup and recovery procedures are designed to help restore data and services in the event of infrastructure failure or other operational incidents.
HR Partner also maintains internal processes designed to support business continuity and service restoration in the event of operational disruptions.
Incident Response
HR Partner maintains internal processes for identifying, investigating, and responding to security incidents.
In the event of a confirmed security incident affecting customer data, HR Partner will notify affected customers without undue delay and work promptly to investigate, contain, and remediate the issue.
Subprocessors & Third-Party Providers
HR Partner works with a small number of carefully selected third-party service providers and subprocessors to help deliver our services, including cloud infrastructure, communications services, customer support tooling, and other operational services.
We conduct due diligence before engaging subprocessors and require appropriate contractual and security obligations where applicable.
A current list of subprocessors used by HR Partner is available on our Subprocessors page.
AI & Data Handling
HR Partner’s AI-assisted functionality is designed with privacy and data minimization principles in mind.
Our AI-assisted functionality does not send employee records or core HR personnel data to external AI providers.
Where AI-assisted recruiting or applicant evaluation features are enabled by customers, limited applicant-provided information may be processed by approved AI providers to support those features.
Certain AI-assisted workflow functionality processes natural language requests only, while customer HR data remains within HR Partner’s systems.
HR Partner does not use customer data submitted through the platform to train public AI models.
Customer Data & Privacy
Customers retain ownership and control of the personal data they store within HR Partner.
HR Partner supports customer privacy and data protection obligations through:
- Access controls and permissions management
- Data export and deletion capabilities
- Documented processor obligations
- International transfer safeguards
- Security and confidentiality controls
Customers may request export or deletion of their data in accordance with our Terms of Use and applicable legal obligations.
For more information about privacy, GDPR, and international data transfers, please refer to our:
Responsible Disclosure
If you believe you have identified a potential security vulnerability relating to HR Partner, please contact us at support@hrpartner.io with relevant details. While we do not operate a public bug bounty programme, we review legitimate security reports submitted in good faith. Please avoid any testing that could disrupt services, access or expose customer data, or negatively affect the availability or security of the platform.
Frequently asked questions
HR Partner is hosted using Amazon Web Services (AWS), a leading global cloud infrastructure provider.
Yes. HR Partner uses encryption to help protect customer data both in transit and at rest.
HR Partner uses secure authentication, role-based permissions, and internal access controls to help protect customer accounts and data. Customers are responsible for managing their own user access and removing users who no longer require access.
No. Payment information is processed by secure PCI-compliant payment providers. HR Partner does not store full payment card details on its own systems.
Yes. HR Partner uses a small number of carefully selected subprocessors and third-party providers to support infrastructure, communications, customer support tooling, and other operational services.
A current list of subprocessors is available on our Subprocessors page.
HR Partner maintains internal incident response processes for identifying, investigating, and responding to security incidents. In the event of a confirmed incident affecting customer data, affected customers will be notified without undue delay.
Yes. Customers may request export or deletion of their data in accordance with our Terms of Use and applicable legal obligations.
No. HR Partner does not use customer data submitted through the platform to train public AI models.
Related Documentation
Questions?
If you have questions about HR Partner’s security practices or data protection approach, please contact us at support@hrpartner.io.
Document Information
This page reflects HR Partner’s current security practices and operational safeguards.
We may update this page from time to time as our services and security practices evolve.
Last Updated: August 2026