RLS tenant isolation
Every tenant table carries workspace_id. Postgres row-level security checks membership on every query; workspace code also filters explicitly.
Security
Controls we can show you in the product
No ISO or SOC badges here — only mechanisms that are implemented and testable today.
Encryption of IBANs
IBANs, passport numbers, Emirates IDs and labour card numbers are encrypted with AES-256-GCM at the application layer, with masked last-four columns for display.
2FA and recovery codes
Owners, HR admins and payroll must complete TOTP (AAL2) before privileged routes. Recovery codes elevate a session and force re-enrolment.
Audit logs
Creates, updates and deletes on HR data write append-only audit rows via database triggers. Sensitive field reveals are logged too.
Hosting region
The application runs on Vercel. The primary Postgres database for WorkAlto is hosted on Supabase in Singapore (ap-southeast-1).
Backups
Database backups are provided by the managed Supabase plan. Point-in-time recovery depends on that plan tier.
See WorkAlto on your own data
Book a walkthrough, or start a free trial workspace on app.workalto.com.