Each company sealed off
Every request is checked on the server against the company it belongs to before any data is read or written. One company’s users can never reach another company’s records, whatever the app shows. EpicHRM staff who run the platform see company names, plans and counts, not employee records.
Roles and permissions
- Built-in roles: Company Admin, HR Manager, Manager (sees and approves for their own team) and Employee (self-service only).
- Custom roles let a company grant exactly the permissions it wants.
- Permissions are enforced by the API; the app only hides what a person cannot use.
- Nobody joins a company by finding a sign-up page. Each person is invited by email.
Sign-in
- Passkeys (Face ID, fingerprint, Windows Hello) for sign-in. Biometric data never leaves the person’s device.
- Attendance check-in and check-out each need a fresh passkey confirmation, so nobody can clock in for a colleague.
- Passwords are stored only as Argon2 hashes. Resetting a password also removes the account’s old passkeys.
- Sessions use a cookie that page scripts cannot read, sent only over HTTPS, and expire after 30 days.
- Sign-in, password reset and other sensitive endpoints are rate-limited.
Encryption
- All traffic uses HTTPS, with HSTS so browsers never fall back to plain HTTP.
- The database and file storage are encrypted at rest by our providers (MongoDB Atlas and Cloudflare R2).
Files
- Documents, receipts and photos live in a private bucket that is never publicly listed.
- Files never pass through a public link: the app issues a signed link that expires after 10 minutes for uploads and 5 minutes for downloads.
- Each upload’s size and file type is checked before it is accepted.
Records of changes
Sensitive changes, such as a new photo on an employee record, a role change or a platform-level plan change, are logged with who made them and when.
The assistant
The optional assistant sees only what the person using it is already allowed to see, and it changes nothing until that person confirms. Customer data is not used to train AI models.
Backups and continuity
The database is backed up regularly and backups are kept for 30 days. The mobile apps keep the last data they loaded readable when the connection drops, and say clearly when they are offline.
Web protections
The app sends security headers that stop it being framed by other sites, stop browsers guessing file types, and limit referrer data and device permissions.
Reporting a vulnerability
If you believe you have found a security problem, email info@epickod.com with the details. Please give us reasonable time to fix it before disclosing it, and don’t access or change data that isn’t yours while testing. We won’t take action against good-faith research that follows these rules.