Skip to content
INKLUDO
Security Overview

Built to protect. Designed to be audited.

A plain-English account of every security layer Inkludo uses to protect your employee data — encryption, access control, backup, continuity, and vulnerability management.

AES-256 encryption
TLS 1.3 in transit
4-role RBAC
Data stored in India
Security Architecture

Engineered for compliance.

Explore the eight pillars of Inkludo's security architecture.

Security OverviewTopic ID: overview

How Inkludo protects your people data.

The Security Promise

Your employee data belongs to you. We store it in India, encrypt it end-to-end, restrict access by role, and give you the tools to export or delete it at any time.

Key Technical Safeguards
01
Security promise

Zero-surprise security: transparent practices, honest certifications, and data portability on day one. We publish what we do, not just what sounds good.

02
What we protect

Employee PII (Aadhaar, PAN, bank accounts), payroll figures, attendance biometrics, document archives, and all HR correspondence managed inside Inkludo.

03
How we protect it

AES-256 encryption at rest, TLS 1.3 in transit, 4-role RBAC, immutable audit logs, and daily backups with 30-day retention. Every layer is intentional.

04
Where your data lives

Exclusively in India on AWS ap-south-1, hosted inside ISO 27001-certified, tier-IV data centres. No data is transferred outside India without your explicit written consent.

05
Who can see your data

Only people you authorise via RBAC. No Inkludo employee accesses your production data without an active support ticket generating a logged audit trail.

Frequently Asked Questions

Common questions on security overview

Security & Compliance

Every layer, explained.

Eight independent security layers protect your employee data at every step — from the moment it enters Inkludo to the moment you export it.

AES-256 encryption at rest, TLS 1.3 in transit
4-role RBAC — zero privilege escape
Data stored in India, never transferred out
Immutable audit logs, 12-month retention

Security question from your IT team? Talk to our security team →

Drag or click top card to cycle through security layers

inkludo.work/securityProtected

Security layers active

AES-256 EncryptionActive
TLS 1.3 in transitActive
4-Role RBACActive
Audit loggingActive

Data stored in

India 🇮🇳

Incidents

0 active

Uptime

99.9%

Security Overview

All tiers

Every security layer, explained. AES-256 + TLS 1.3 + RBAC + India data residency + audit logs — active and monitored.

db.inkludo/employees🔐 Encrypted
employee_records2,450 rows · encrypted
namePriya SharmaPII
bank_account••••••••3421SENSITIVE
salary₹••,•••SENSITIVE
panABCPQ••••FPII
Field-level encryption active · AES-256 · KMS-managed keys

Data Security

All tiers

Every field classified at ingestion. Sensitive fields (salary, bank, PAN) encrypted at field level with AWS KMS-managed keys.

TLS 1.3 handshake✓ Secure
$ openssl s_client -connect probey.inkludo.work:443Protocol : TLSv1.3Cipher : TLS_AES_256_GCM_SHA384Key size : 256 bitVerify return code: 0 (ok)

At Rest

AES-256

In Transit

TLS 1.3

Passwords

bcrypt

Sessions

RS256 JWT

Encryption

All tiers

No unencrypted path exists. AES-256 at rest, TLS 1.3 in transit, bcrypt passwords, RS256 JWTs — every layer covered.

RBAC permissions4 roles
PermissionOwnerHR AdminMgrEmp
Run payroll
View all salaries
Approve leaves
View own payslip
Manage roles

Access Control

All tiers

4-role RBAC enforced at every API endpoint. A Manager cannot view another department's salary — the API returns 403.

AWS ap-south-1 · VPCPrivate

Network topology

Internet
ALB
Private subnet
DB: no public IP
·
Redis: no public IP

Region

ap-south-1

Tier

ISO 27001

Secrets

AWS KMS

Infrastructure Security

All tiers

Private VPC on AWS Mumbai. No database or cache exposed to the internet. Secrets managed via AWS KMS — never in code.

MongoDB Atlas · BackupRunning
Today's backup · 01:00 IST✓ Complete
2,450 collectionsEncrypted · ap-south-2 replica

Retention

30 days

RTO

< 4 hrs

PITR

1-min

Backup & Recovery

Enterprise

Daily automated backups, 30-day retention, 1-minute PITR, RTO < 4 hours. Restores tested quarterly.

uptime · SLA monitorAll systems operational
Monthly uptime · Enterprise tier99.9%
30 days1 maintenance window

Failover

< 30 sec auto

AZ coverage

Multi-AZ

Business Continuity

Enterprise

99.9% uptime SLA, multi-AZ redundancy, auto-failover in < 30 seconds. Payroll never misses its run date.

$ snyk test --all-projects✓ Pass
Scanning 847 dependencies...Running SAST analysis...
Critical0 found
High0 found
Medium2 found · scheduled patch
Low4 found · next release
✓ Build passed · no blocking CVEs

Vulnerability Management

All tiers

Snyk + npm audit on every CI build. Critical CVEs patched in 24h. Annual external pen-test by CREST-certified firm.

01/08
Talk to Us

Security questions from your IT or procurement team?

We respond to security questionnaires, vendor assessments, and DPA requests within 2 business days.

Security-first HR.Built for Indian enterprises.

Industry Recognition

Ranked #1 for usability, adoption, and fast ROI.

Consistently recognized by thousands of verified enterprise reviews on G2, Capterra, and Crozdesk.

SUMMER 2026G2
Most Implementable
SUMMER 2026G2
Highest User Adoption
SUMMER 2026G2
Most Implementable
SUMMER 2026ASIA PACIFICG2
Regional Leader
SUMMER 2026ASIA PACIFICG2
Regional Leader
CcrozdeskQUALITYCHOICETOP RANKED SOLUTION
Software AdviceFRONTRUNNERS
CapterraSHORTLIST