Security is fundamental to how Hafinen builds, operates, and delivers its platform.
Hafinen is designed to help organizations manage sensitive workforce, payroll, recruitment, attendance, compliance, and operational data. We understand the importance of protecting this information and apply security practices intended to safeguard confidentiality, integrity, and availability.
This Security Overview provides transparency into Hafinen’s security practices, infrastructure protections, and operational controls.
Security Principles
Hafinen’s security model is built around five core principles:
- Confidentiality of customer data
- Integrity of workforce and payroll records
- Availability and resilience of services
- Accountability through auditability
- Privacy by design
Security controls are integrated into both product design and infrastructure operations.
Infrastructure Security
Hafinen’s infrastructure is hosted using trusted cloud providers and network security vendors.
Core infrastructure providers include Amazon Web Services (AWS), Contabo, and Cloudflare.
Infrastructure protections include network segmentation, firewall controls, distributed denial-of-service (DDoS) protection, traffic filtering, TLS encryption, secure API gateways, secure backups, and environment isolation.
Hafinen maintains production and development environment separation where operationally required.
Encryption
Hafinen protects data using encryption.
Data in Transit
All data transmitted between users, APIs, integrations, and Hafinen systems is protected using TLS encryption.
This includes web traffic, API traffic, webhook communication, and authentication requests.
Data at Rest
Sensitive data stored within Hafinen systems is protected using encryption where appropriate, including credential data, access tokens, system secrets, and backups.
Authentication and Access Controls
Hafinen applies layered access controls.
These include role-based access controls (RBAC), permission-based system access, session validation, password hashing, account recovery protections, access logging, and administrative access restrictions.
Customers are responsible for managing internal user permissions.
Biometric Security
Hafinen supports biometric attendance integrations including fingerprint systems and facial recognition systems.
Hafinen does not store raw biometric images.
Integrated biometric systems store encrypted biometric templates or tokens.
Hafinen processes only attendance events, timestamps, and authentication outcomes required for attendance workflows.
Customers remain responsible for lawful employee notices, consent requirements, and local biometric compliance.
API Security
Hafinen offers APIs and webhook support.
Security controls include token-based authentication, webhook validation, request signing where applicable, rate limiting, abuse monitoring, and access revocation.
API credentials should be stored securely by customers.
Monitoring and Logging
Hafinen continuously monitors for service reliability, suspicious activity, unauthorized access attempts, API abuse, infrastructure anomalies, and failed authentication events.
Security-relevant actions are logged to support investigations and accountability.
Vulnerability Management
Hafinen maintains an ongoing vulnerability management process.
This includes dependency updates, patch management, infrastructure hardening, access reviews, and configuration audits.
Critical vulnerabilities are prioritized based on severity and exposure.
Incident Response
Hafinen maintains an internal incident response process for handling, unauthorized access, service outages, data exposure, security events, and infrastructure failures.
Incident priorities are assessed based on Impact, scope, data sensitivity, and operational risk.
Where legally required or contractually obligated, affected customers will be notified without undue delay.
Business Continuity and Backups
Hafinen maintains backup processes designed to support operational recovery.
These include infrastructure redundancy where applicable, backup retention policies, disaster recovery planning, and restoration testing where operationally required.
While Hafinen maintains continuity procedures, customers are encouraged to maintain independent exports of critical business records.
Data Retention and Deletion
Customer data remains available during active subscription periods.
After termination:
- customer data may remain available for up to 90 days
- export requests may be made during this period
- data may be deleted after the retention period
Retention may extend where legally required.
Employee and Internal Security Practices
Hafinen applies internal operational controls including least-privilege access, credential management, internal access reviews, confidential handling of customer information, and controlled production access.
Access to customer data is restricted to authorized personnel only where necessary.
Subprocessors
Hafinen uses carefully selected subprocessors to support infrastructure, communications, and payments.
A current list of subprocessors is available at:
https://www.hafinen.com/subprocessors
Customer Security Responsibilities
Security is a shared responsibility.
Customers are responsible for user permission management, lawful data collection, secure endpoint devices, credential security, internal HR access governance, lawful biometric collection, lawful payroll handling, and secure integration configurations.
Responsible Disclosure
If you discover a security issue affecting Hafinen, please report it responsibly.
Security reports can be submitted to:
[email protected]
Please include issue description, reproduction steps, affected areas, and supporting evidence where available.
We review all legitimate reports.
Security Updates
Hafinen may update this Security Overview to reflect evolving practices, infrastructure changes, and legal requirements.
Contact
Hafinen Limited 107 Lower Kabete Road Westlands, Nairobi, Kenya Legal: [email protected]Security: [email protected]
