Peoplora Security & Trust

1. Executive summary

Peoplora is a modern human resource management platform. Security, privacy, and reliability are built into how we design, ship, and operate the product—not added as an afterthought.

We are not yet ISO 27001 certified. Our systems and processes are developed in alignment with widely recognized frameworks, including ISO 27001 and SOC 2 control themes, so that security expectations stay enterprise-grade from day one while we grow.

We do not claim certifications we have not earned. We are transparent about our roadmap and happy to discuss controls with your security and procurement teams.

2. Infrastructure & hosting

Peoplora runs on Amazon Web Services (AWS). We use managed services (for example, relational databases and container orchestration) so we benefit from AWS operational maturity, patching, and scaling.

Workloads are deployed with isolation in mind: network segmentation, private subnets for sensitive components, and no direct public access to databases. Today our primary region is in the United States; we design so that additional regions can be added as customer and regulatory needs grow.

3. Data security & encryption

• In transit: TLS 1.2 or higher for client and service communication.
• At rest: Encryption using industry-standard algorithms (e.g. AES-256) for data stored in managed services where supported.
• Secrets: Credentials and keys are not hard-coded in application code; we use environment-specific configuration and secure secret storage patterns appropriate to our stack.
• Production access: Access to production data is limited, logged where feasible, and granted only when needed for support or operations.

Development, staging, and production environments are separated so test data and production customer data do not mix.

4. Access control & identity

• Role-based access: Product and internal tooling use permission models aligned with least privilege.
• Multi-factor authentication: We support MFA for customer accounts where our authentication integration allows it; we continue to strengthen internal and admin MFA coverage as we scale.
• Auditability: We maintain logging sufficient to investigate who did what in the product and in critical infrastructure, within the limits of our current tooling.

5. Application security

We follow practical secure-development habits: validating inputs, protecting APIs, reviewing dependencies, and applying rate limiting and abuse controls where appropriate. Security is treated as an ongoing process—dependency updates, monitoring, and fixes ship continuously rather than as a one-time checklist.

6. Privacy & compliance alignment

Our privacy practices are described in our Privacy Policy. We align with principles found in regulations such as GDPR (for applicable users) and PIPEDA and substantially similar provincial laws in Canada for Canadian personal information, including accountability, limited collection, and safeguards appropriate to the sensitivity of the data.

We do not sell personal information. We process data to deliver and improve the service, as described in our Privacy Policy.

7. Backup, recovery & availability

Databases and critical data stores are backed up on a recurring schedule using AWS-managed capabilities. We target redundancy at the availability-zone level within our region to reduce single-point failures.

Recovery objectives (RTO/RPO) vary by component; we refine these as we formalize operations. If you need specific numbers for a vendor assessment, contact us at security@peoplora.com.

8. Monitoring, logging & incidents

We use AWS-native and application-level logging and monitoring (including services such as CloudWatch) for health, errors, and security-relevant signals. Alerts are routed to the team for triage.

When we detect a potential incident, we follow a practical response path: confirm and scope, contain, recover, and communicate to affected customers where required by law or contract. Details of customer notification are covered in our agreements and privacy documentation.

9. Vendors & third parties

We rely on established providers for infrastructure and specific functions—for example AWS (hosting), Stripe (payments, where applicable), and authentication or other services as listed in our Privacy Policy. These vendors maintain their own compliance programs and certifications; we select them for security track record and contractual protections.

10. Compliance roadmap

Today we are not SOC 2 Type II or ISO 27001 certified. Our controls and documentation are developed so that pursuing formal certifications is a natural next step as customer and regulatory demand increases.

As Peoplora scales, we intend to pursue certifications such as SOC 2 and ISO 27001 aligned with customer and market requirements. We avoid publishing fixed dates here so we do not over-promise; we will update this page as our program matures.

11. Customer responsibilities

Security is shared. You are responsible for maintaining strong passwords, revoking access for departing employees, configuring roles appropriately, and ensuring the data you enter into Peoplora is accurate and permitted for your use case.

12. Contact & transparency

For security questions, questionnaires, or a deeper walkthrough of our architecture with your team, reach us at security@peoplora.com. We are happy to provide additional documentation where appropriate for your procurement process.

A downloadable PDF mirroring this page may be offered later; this web version is always the reference for the latest wording.