Ingia
Weka onyesho

Security Overview

Last updated: July 1, 2026

Security is fundamental to how Hafinen builds, operates, and delivers its platform.

Hafinen is designed to help organizations manage sensitive workforce, payroll, recruitment, attendance, compliance, and operational data. We understand the importance of protecting this information and apply security practices intended to safeguard confidentiality, integrity, and availability.

This Security Overview provides transparency into Hafinen’s security practices, infrastructure protections, and operational controls.

Security Principles

Hafinen’s security model is built around five core principles:

  • Confidentiality of customer data
  • Integrity of workforce and payroll records
  • Availability and resilience of services
  • Accountability through auditability
  • Privacy by design

Security controls are integrated into both product design and infrastructure operations.

Infrastructure Security

Hafinen’s infrastructure is hosted using trusted cloud providers and network security vendors.

Core infrastructure providers include Amazon Web Services (AWS), Contabo, and Cloudflare.

Infrastructure protections include network segmentation, firewall controls, distributed denial-of-service (DDoS) protection, traffic filtering, TLS encryption, secure API gateways, secure backups, and environment isolation.

Hafinen maintains production and development environment separation where operationally required.

Encryption

Hafinen protects data using encryption.

Data in Transit

All data transmitted between users, APIs, integrations, and Hafinen systems is protected using TLS encryption.

This includes web traffic, API traffic, webhook communication, and authentication requests.

Data at Rest

Sensitive data stored within Hafinen systems is protected using encryption where appropriate, including credential data, access tokens, system secrets, and backups.

Authentication and Access Controls

Hafinen applies layered access controls.

These include role-based access controls (RBAC), permission-based system access, session validation, password hashing, account recovery protections, access logging, and administrative access restrictions.

Customers are responsible for managing internal user permissions.

Biometric Security

Hafinen supports biometric attendance integrations including fingerprint systems and facial recognition systems.

Hafinen does not store raw biometric images.

Integrated biometric systems store encrypted biometric templates or tokens.

Hafinen processes only attendance events, timestamps, and authentication outcomes required for attendance workflows.

Customers remain responsible for lawful employee notices, consent requirements, and local biometric compliance.

API Security

Hafinen offers APIs and webhook support.

Security controls include token-based authentication, webhook validation, request signing where applicable, rate limiting, abuse monitoring, and access revocation.

API credentials should be stored securely by customers.

Monitoring and Logging

Hafinen continuously monitors for service reliability, suspicious activity, unauthorized access attempts, API abuse, infrastructure anomalies, and failed authentication events.

Security-relevant actions are logged to support investigations and accountability.

Vulnerability Management

Hafinen maintains an ongoing vulnerability management process.

This includes dependency updates, patch management, infrastructure hardening, access reviews, and configuration audits.

Critical vulnerabilities are prioritized based on severity and exposure.

Incident Response

Hafinen maintains an internal incident response process for handling, unauthorized access, service outages, data exposure, security events, and infrastructure failures.

Incident priorities are assessed based on Impact, scope, data sensitivity, and operational risk.

Where legally required or contractually obligated, affected customers will be notified without undue delay.

Business Continuity and Backups

Hafinen maintains backup processes designed to support operational recovery.

These include infrastructure redundancy where applicable, backup retention policies, disaster recovery planning, and restoration testing where operationally required.

While Hafinen maintains continuity procedures, customers are encouraged to maintain independent exports of critical business records.

Data Retention and Deletion

Customer data remains available during active subscription periods.

After termination:

  • customer data may remain available for up to 90 days
  • export requests may be made during this period
  • data may be deleted after the retention period

Retention may extend where legally required.

Employee and Internal Security Practices

Hafinen applies internal operational controls including least-privilege access, credential management, internal access reviews, confidential handling of customer information, and controlled production access.

Access to customer data is restricted to authorized personnel only where necessary.

Subprocessors

Hafinen uses carefully selected subprocessors to support infrastructure, communications, and payments.

A current list of subprocessors is available at:

https://www.hafinen.com/subprocessors

Customer Security Responsibilities

Security is a shared responsibility.

Customers are responsible for user permission management, lawful data collection, secure endpoint devices, credential security, internal HR access governance, lawful biometric collection, lawful payroll handling, and secure integration configurations.

Responsible Disclosure

If you discover a security issue affecting Hafinen, please report it responsibly.

Security reports can be submitted to:

[email protected]

Please include issue description, reproduction steps, affected areas, and supporting evidence where available.

We review all legitimate reports.

Security Updates

Hafinen may update this Security Overview to reflect evolving practices, infrastructure changes, and legal requirements.

Unaweza kuchagua ni vidakuzi vipi vya hiari ambavyo Hafinen anaweza kutumia ili kuboresha matumizi yako. Ni muhimu sana na vidakuzi vya usalama huwashwa kila wakati kwa sababu ni muhimu kwa uthibitishaji, usalama wa jukwaa, kuzuia ulaghai na utendakazi wa kuaminika wa Huduma. Unaweza kusasisha mapendeleo yako wakati wowote.

Vidakuzi vya lazima kabisa

Vidakuzi hivi ni muhimu kwa Hafinen kufanya kazi kwa usalama na kwa uhakika. Zinaauni uthibitishaji wa akaunti, vipindi vya kuingia katika akaunti, ulinzi wa CSRF, mwendelezo wa kipindi salama, kusawazisha upakiaji na utendakazi mwingine msingi wa jukwaa. Kwa sababu vidakuzi hivi vinahitajika ili Huduma zifanye kazi, haziwezi kulemazwa.

Vidakuzi vya Usalama

Vidakuzi hivi husaidia kulinda akaunti yako na Huduma kwa kugundua shughuli za kutiliwa shaka, kuzuia ufikiaji usioidhinishwa, kupunguza matumizi mabaya, kuthibitisha maombi ya API, kusaidia kupunguza viwango na kudumisha uadilifu wa jukwaa. Vidakuzi hivi vinahitajika kwa usalama na haziwezi kuzimwa.

Vidakuzi vinavyofanya kazi

Vidakuzi vinavyofanya kazi hukumbuka mapendeleo yako na kubinafsisha matumizi yako. Wanaweza kuhifadhi lugha, saa za eneo, mandhari, mipangilio ya ufikivu, ugeuzaji kukufaa kiolesura, na mapendeleo ya dashibodi kwa hivyo huhitaji kusanidi kila wakati unapotumia Huduma.

Vidakuzi vya uchanganuzi

Vidakuzi vya uchanganuzi hutusaidia kuelewa jinsi Huduma zinavyotumiwa ili tuweze kuboresha utumiaji, utendakazi na kutegemewa. Hukusanya maelezo kama vile upitishaji wa vipengele, mwingiliano wa ukurasa, mifumo ya kusogeza, uoanifu wa kivinjari, ripoti za kuacha kufanya kazi na vipimo vya utendakazi. Inapowezekana, maelezo haya yanajumlishwa au hayatambuliwi.

Vidakuzi vya Utendaji

Vidakuzi vya utendakazi huboresha kasi, uthabiti na uitikiaji wa Huduma. Zinaauni akiba, uboreshaji wa uwasilishaji wa maudhui, kusawazisha trafiki, upakiaji wa vipengee, na teknolojia zingine zinazosaidia kutoa hali ya utumiaji thabiti na inayotegemewa.

Vidakuzi vya Mawasiliano

Vidakuzi vya mawasiliano vinaauni mwingiliano unaohusiana na huduma kama vile uwasilishaji wa arifa, ufuatiliaji wa matukio ya barua pepe, uthibitishaji wa SMS na utendakazi mwingine wa mawasiliano unaoboresha jinsi tunavyokufahamisha unapotumia Huduma.