Sensitive fields are masked and encrypted
PAN is stored masked in the interface, with the raw value encrypted at rest. Nobody views a full PAN by opening a profile page; the record itself never displays it in the clear.
Security
How we build LekhaHR to keep employee data narrow.
This page describes real, defensible practices already reflected in the product — not a certification. We'll tell you plainly where we haven't completed formal compliance work.
Location only at a punch, never in the background
LekhaHR can capture location when an employee checks in or out and validate the configured office geofence. It does not track movement in the background, build travel routes or monitor employees between punches.
Field-level access enforced on the server
Roles don't just hide fields in the interface. The server omits them from the response, so a manager's view of an employee's record leaves out salary and finance fields entirely; they aren't sent to the browser and greyed out, they're absent.
Every policy change and manual override is logged
Attendance and leave policy edits, manual overrides and corrections write to an audit log tied to the change and the person who made it, not just the current-state record.
Per-tenant isolation at the database layer
Each company's data is scoped with row-level security in the database, not application-level filtering alone. One tenant's queries cannot reach another tenant's rows.
Private file storage with automatic deletion
Punch-in selfie evidence is stored in private object storage, registered to the employee who captured it, and deleted automatically after 30 days. Files aren't publicly reachable by URL; access is authorized per request.
What we don't claim
No certification badges we haven't earned.
We do not claim SOC 2 or ISO 27001 certification, and we do not claim GDPR or DPDP compliance as a guaranteed status. If your procurement process needs a specific certification or a security questionnaire answered, email hello@lekhahr.com and we'll tell you honestly where we stand.
Security FAQ
Straight answers, including where we say no.
Is LekhaHR SOC 2 or ISO 27001 certified?
No, not yet. This page describes the concrete practices we build with today (field-level access, audit logging, tenant isolation, private file storage), not a completed compliance certification. We won't claim a certification we don't hold.
Is LekhaHR GDPR or DPDP compliant?
We build with data-minimization and access-control principles that support compliance work, but we don't guarantee GDPR or DPDP compliance as a certified status. Compliance depends on how your organisation configures and uses the product too, not the software alone.
Does LekhaHR track employees' location continuously?
LekhaHR can capture location when an employee checks in or out and validate the configured office geofence. It does not track movement in the background, build travel routes or monitor employees between punches.
Who can see an employee's salary or finance details?
Only roles explicitly granted that access, and the restriction is enforced server-side. A manager's view of a report's profile does not include finance fields in the data sent to their browser, not just in what's displayed.
What happens to a selfie captured at punch-in?
It's stored privately, tied to the employee who captured it, and deleted automatically after 30 days. It isn't used for anything beyond that punch's evidence record.
How is my company's data kept separate from other LekhaHR customers?
Each tenant's data is isolated with row-level security at the database layer, so a query scoped to one company cannot read another company's rows.
How do I report a security issue?
Email hello@lekhahr.com with what you found. A person reads and replies to that inbox directly.