How we protect dataSecurity FAQ
How we protect your data.
Inkludo uses multiple, overlapping technical and organisational controls to protect data. No single control is treated as sufficient.
Encryption at rest
AES-256 encryption on all stored data — payroll, employee PII, and statutory identifiers
Encryption in transit
TLS 1.2+ enforced on all connections; plain HTTP is rejected at the infrastructure level
Tenant isolation
Every customer's data is logically separated — cross-tenant queries are architecturally impossible
Secret management
All credentials, API keys, and tokens are stored in environment-isolated secret managers, never in code
Data masking
Production data is never copied to non-production environments; test environments use synthetic data
Deletion
Data deletion requests are fulfilled within 30 days with an audit log confirming the action