Isolation between companies
Enforced in the code and again with Row Level Security in the database. Two independent layers.
Security and trust
Security and trust at HRAI: tested on every code change
HRAI keeps companies apart twice, in the application code and in the database with Row Level Security, removes sensitive fields on the server, and runs thousands of automated tests, 76 of them dedicated security tests, before any deployment. Our own security review included live attacks on a running server, and full on-premises installation is available.
Last reviewed
Method
How do we know the security works?
A deployment does not go out if any test fails. That includes the full permission matrix, every role against every group of routes, and the tenant-isolation tests.
And what was open, because it is better said than left out: DNS rebinding, the window between checking an address and connecting to it. Since September 2026 the server connects directly to the IP address it checked, so that window is closed in the code rather than left to a cloud provider’s protection.
Defense in depth
How is every request checked before data leaves the server?
Six checks, in order. Isolation between companies is enforced twice, by two layers that do not depend on each other.
Layers
What protects what?
Role-based permissions
6 roles. Sensitive fields are removed on the server, not hidden in the interface, so they never reach the browser.
Two-factor sign-in
Available to every user, with rate limiting on sign-in attempts.
SSRF protection
Any external address the system calls is checked in three layers, including the IP returned by DNS and a re-check on every redirect.
Personal data scrubbing
A bug report is filtered automatically for ID numbers, phone numbers, emails, salaries and keys before it is stored.
Encrypted secrets
Keys for external providers are stored encrypted and shown masked only.
A master key with rotation
Secrets are encrypted with a master key kept apart from the data. Rotation re-encrypts all of them in one operation.
Silence toward strangers
A request for a resource that is not yours returns “not found”, and an unregistered WhatsApp number gets no reply. A “no permission” answer would reveal that the resource exists.
Sensitive fields
Who can see salary, ID numbers and bank details?
Removed on the server
A team manager sees their people, without the sensitive fields
Only full-management roles see salary and bank details. For everyone else the fields are removed before the response leaves the server, so there is nothing to reveal in the browser’s developer tools.
- Team managers see their own people only
- Without salary, ID number or bank details
- The same rule applies to a connected AI assistant, whose field list is closed
What a team manager receives
- Name, role and team
- Attendance and leave
- Tasks and approvals
What the server removes first
- Salary
- ID number
- Bank details
Control
Where does the data live, and can you take it with you?
A full on-premises installation runs everything on your server, and no data leaves your organization. In both deployment models the data can be exported in full at any time, including signed documents and their complete record.
| Cloud | On-premises | |
|---|---|---|
| Where it runs | Dedicated infrastructure; storage location set in the agreement with your organization | Your own server, installed with Docker |
| Does data leave the organization? | Processed by the subprocessors listed in the privacy policy | No |
| Isolation between companies | Application code and Row Level Security | Application code and Row Level Security |
| Full export | At any time | At any time |
| Backups | Daily backups with a defined retention period | Managed by your organization |
Rights in the system itself
Access and deletion requests are tools, not support tickets
An employee may ask for a copy of their personal data, and the system produces it. HR can remove identifying details from a file while keeping the records the law requires, in a form that can no longer be linked to the person.
- A full, structured copy of a person’s data: documents, attendance and requests
- Removal of identifying details, keeping law-required records unattributable
- End of contract: export first, then a 60-day archive, then deletion, including backups
- No selling of data and no model training on it
Written under Israeli law: the privacy policy is written under the Protection of Privacy Law, 5741-1981 (Hok Haganat HaPratiyut) as amended by Amendment 13 (in force since August 14, 2025), and the Information Security Regulations, 2017. A summary in English: Legal summary.
- Step 1 Full export One file with all account data, readable without the system.
- 60 days Archive Closed to use; can be restored until the date shown in advance.
- Then Deletion Irreversible. Backups made before it are not used for restore and are replaced as the backup cycle runs.
Who it is for
Who relies on these controls?
IT and security
Isolation in two layers, encrypted secrets, a master key with rotation, and an on-premises option.
HR
Role-based access, an audit log of every action, and access and deletion tools inside the system.
Team managers
Their people and their approvals, without salary, ID numbers or bank details.
Employees
A copy of their own data on request, and their sensitive details shown only to the roles that need them.
Sources
Official sources for this page
Sources checked on . This page describes HRAI’s technical controls. It is not legal advice and not a certification.
Frequently asked
What people ask before they start
Has HRAI been penetration tested?
Not by an independent third party. We ran our own security review (August 2026) that included static scanning and live attacks against a running server. Every finding was reproduced, fixed and covered by an automated test that fails if the problem comes back, and those attacks run again automatically. It is an internal review, not an independent third-party penetration test.
Where is the data stored?
Either in the cloud on dedicated infrastructure, or in a full on-premises installation on your own server with Docker, where no data leaves your organization. In the cloud, the storage location is set in the agreement with your organization.
How is one company kept apart from another?
In two independent layers: in the application code, and in the database itself with Row Level Security. A programming mistake in one layer does not expose another company’s data.
Who can see salaries and bank details?
Only full-management roles. A team manager sees their people without salary, ID number or bank details. The fields are removed on the server, so the data never reaches that manager’s browser in the first place.
Is HRAI ISO 27001 certified?
To be precise, because we only state what is true: the standard certifies an organization, not software. HRAI provides the technical controls such a certification relies on, including role-based permissions, a tamper-resistant audit log, encrypted secrets and isolation between companies. For full certification the organization adds its own policies, two-factor sign-in for managers and periodic access reviews.
Does HRAI use our data to train AI models?
No. The data your organization enters belongs to your organization. We do not acquire ownership of it, do not use it to train models and do not sell it, and a full export is available at any time, as the terms of use state.
Get started
Book a demo
Leave your details and we will get back to you within one business day to set a time for a 30-minute demo on your own processes. If it turns out not to be a fit, we will say so.
About the details you share. Data controller: Career and Content ltd (operator of HR AI), company no. 515523934, [email protected]. You are not legally required to provide them; without a name and email we cannot get back to you, and that is the only consequence. The information is used to respond to your inquiry, kept for up to 24 months, and shared only with our email provider and our sales team. You may review, correct or delete it at any time at the same address — Privacy Policy (Hebrew), English summary.