Encrypted everywhere
Every connection to HRFlex is encrypted in transit, and employee, payroll and document data are encrypted at rest.
Security & compliance
Built to hold the most sensitive data an organisation has
Salaries, bank details, identity documents and performance records for tens of thousands of people. HRFlex is engineered, operated and audited for that responsibility, for banks, energy companies and public-sector organisations.
What every client gets
Two-factor sign-in and step-up
Authenticator-app codes, recovery codes and trusted devices; privileged roles are required to use two-factor, and sensitive actions ask again.
Role-based and scoped access
Over twenty administrative roles, each with an access scope, so an administrator sees only the organisations and people they are responsible for.
Audit trail on every change
Who changed what, when, and the value before and after, on employee records, payroll, approvals and settings, reportable by the client.
Sign-in protection
Password policy and history, lock-out on repeated failures, new-device and unusual-location alerts, and single sign-on with Microsoft Entra ID where the client uses it.
Validated uploads
Every uploaded document is type-checked and scanned before it is stored, and every bulk upload is previewed and validated before a row is written.
Backups and recovery
Automated, encrypted backups with point-in-time recovery, tested restores, and a client's data held separately from every other client's.
Edge protection
A web application firewall, bot filtering and rate limiting in front of every client site, with security headers on every response.
How we operate
Security is a programme, not a feature list. These are the commitments behind the controls.
- SOC 2 attestation in its final stage; ISO 27001 certification in progress.
- Secure development: dependency and code scanning on every change, security review before release, and a published cadence of security releases.
- Least-privilege operations: production access is named, logged and reviewed; application accounts hold only the permissions they need.
- Data protection: processing under the Nigeria Data Protection Act; client data is used only to provide the service and is returned or deleted at contract end.
- Vulnerability disclosure: report a concern to the address below and we will acknowledge it within two working days.
Security questionnaires and audit reports. Clients and prospects under NDA can request our current attestation documents and complete a vendor questionnaire with us. Write to info@quetzalconsults.com or book a call.
Boost your HR team's productivity with HRFlex™
One platform and one employee record, from the first application to the final payslip. See it running on your own processes.