Payroll and HR data, protected at every step
Salaries, bank accounts, PAN, Aadhaar and face data are among the most sensitive things a company holds. This page sets out how AiroHR protects them: who can sign in, who can see what, what needs a second person to approve, and what is recorded.
Only the right people get in
Every HR and employee login goes through the same hardened sign-in, on the web and in the mobile apps.
2-step sign-in
Turn on codes from an authenticator app (Google Authenticator, Microsoft Authenticator and other standard TOTP apps), with one-time recovery codes. A code works once, and the secret behind it is stored encrypted. HR can see who has it on in Users & Access.
Single sign-on (SAML 2.0)
Sign in through your company's identity provider, for example Microsoft Entra ID, Okta or Google Workspace. Signed assertions are verified, and each sign-in response can only be used once.
Enterprise plan · set up with our teamPasswords stored safely
Passwords are hashed with Argon2id, a slow, memory-hard algorithm built to resist cracking. Nobody, including our team, can read a password back.
Lockout on guessing
After 5 wrong passwords, that login is locked for 15 minutes from that address. Failed sign-ins are recorded and shown to HR.
Sessions that end
A signed-in session ends after 30 minutes without activity and after 8 hours at most. Changing a password, or HR removing someone's access, signs that person out.
HR and employee logins kept apart
A person who is both an HR admin and an employee has two logins. Switching between them needs the other login's password (and its 2-step code, when it is on).
Everyone sees only what they need
Access is set per person in Users & Access, on three levels: what someone may do, which modules they may open, and which employees they may see.
Roles and permissions
Business Owner, Admin and Manager roles, plus your own custom roles, each with a clear permission matrix: view or edit employees, attendance, payroll, approvals and more.
Module access
Limit an admin to the modules they work in, for example attendance and leave only. Pages outside those modules cannot be opened, even by typing the address.
Branch and department scope
Restrict an admin to chosen branches, departments or a named list of employees. Lists, approvals, reports and exports all follow that scope.
Several companies, one login
Groups manage several companies from one login, and each company's data stays separate: every record carries its company, and every query is checked against it.
Money moves only after a second check
The riskiest changes in payroll are the ones that redirect or release money. In AiroHR those need a second person.
Bank changes need approval
When an employee changes their bank account, it waits as pending until HR approves it in Bank Change Review. Until then salary goes to the last approved account, and the payout file never uses a pending one.
Multi-level approvals
Leave, loans, salary advances and reimbursements can go through several approval steps, each with a named approver, before they count.
No approving your own request
An admin cannot approve their own leave, loan or claim, or decide their own fine or fine dispute.
Locked payroll stays locked
Once a payroll month is finalized, its salaries, fines and attendance cannot change. Reopening it needs an account owner and a one-time code sent to the registered company contact.
Fines are approved first
Late and early fines are approved by HR before payroll deducts them, and employees can dispute a fine with a reason and proof.
Statutory files from locked data
The PF ECR file, ESI data and bank transfer files are built from the finalized payroll, so what you upload always matches what was paid.
Who did what, and when
- Approvals, payroll actions, settings changes, access changes and sign-ins are recorded with the person, the time and what changed.
- Tamper-evident: each audit record carries a keyed hash, so an edited record can be detected.
- HR reads activity and failed sign-ins in Users & Access, and payroll changes in the payroll audit log.
- Audit records are kept for 365 days.
Data protection
- HTTPS only, with HSTS and strict browser security headers (content security policy, no framing by other sites).
- Encrypted at rest with libsodium: face templates, 2-step secrets, single sign-on certificates and saved statutory-portal and payout credentials.
- Private file storage: documents, proofs and photos are kept outside the public web and handed out only after a permission check. Uploads are checked by their real content, so a script renamed to .pdf is refused.
- Masked bank numbers on employee links: only the last 4 digits are shown.
Built for India's DPDP Act
The Digital Personal Data Protection Act, 2023 gives employees rights over their data. AiroHR is built around them:
- Face attendance only after the employee's consent, with the right to see, correct or delete their face data.
- An employee's documents, payslips and photos open only for that employee and for HR users allowed to see them.
- A named Grievance Officer and an account deletion process.
Read the full Privacy Policy.
Security review for your team
Running a vendor security check before you buy? Send your questionnaire to admin@airohr.com, or ask for a walk-through of Users & Access, the audit log and approvals in a demo.
Talk to us Compare plansSecurity questions, answered
Can our employees see each other's salary or documents?
No. The employee app and portal show each person only their own payslips, attendance, leave, documents and requests. A line manager additionally sees the work reports, tasks and disputes of the people who report to them, not their pay.
Can we limit an HR executive to one branch?
Yes. In Users & Access, give the admin a data scope: chosen branches, departments, or a named list of employees. Employee lists, attendance, approvals, reports and exports then only show those people. You can also limit which modules each admin can open.
Do you support two-factor authentication and single sign-on?
Yes. Any HR or employee login can turn on 2-step sign-in with an authenticator app such as Google Authenticator or Microsoft Authenticator, with one-time recovery codes. Enterprise customers can also sign in through their own identity provider with SAML 2.0 single sign-on, which our team sets up with you.
Can someone change an employee's bank account just before payday?
Not on their own. A bank change made by the employee is held as pending until HR approves it, and salary keeps going to the last approved account until then. Every change is recorded in the audit log.
Can AiroHR staff open our account?
Only our support team, only to help you with something, and every support session is recorded in an impersonation log with who opened which account and when.
How do we export or delete our data?
Employee records, attendance, payroll registers and statutory reports can be exported to Excel at any time. To close your account and have your data deleted, use the Account Deletion page or write to our Grievance Officer.
How do we report a security problem or send a security questionnaire?
Email admin@airohr.com with "Security" in the subject. Please do not include passwords or employee data in the email.
This page describes AiroHR as of October 2026. Single sign-on is part of the Enterprise plan; everything else on this page is in every plan.
See the controls for yourself
Book a demo and we will walk your HR and IT team through access, approvals and the audit log.
Book a demo