Security

An HR system holds some of the most sensitive information a company has: salaries, bank accounts, PAN and Aadhaar details, medical leave, performance reviews. We treat protecting that data as part of the product, not an add-on. This page explains the practices we follow and the controls you have as a customer.

Role-based access control

Not everyone needs to see everything. Qrew HR is built around roles, so each person sees only the data and actions their role allows.

• Employees see their own profile, attendance, leave, payslips and documents.
• Managers see information about their own team, such as attendance, leave and performance, and approve their team's requests.
• HR and payroll admins get access to the records and modules they are responsible for.
• Leadership can be given organisation-wide reports without edit rights.

Admins can go further with field-level permissions, for example letting HR see bank details while hiding them from managers, or deciding which profile fields employees can edit themselves and which changes need approval.

Encryption in transit

All traffic between your browser or the mobile app and Qrew HR is sent over HTTPS using TLS encryption. That applies to the marketing site, the app at app.qrewhr.com and the data exchanged by the mobile app, so information such as login details and payslips cannot be read in transit.

Access logs and audit trails

Knowing who changed what, and when, matters for HR operations and for audits. Qrew HR keeps records of important actions such as profile changes, approvals and payroll runs, so admins can trace how a record reached its current state. Approval workflows also leave a trail showing who approved or rejected each request. Detailed audit logs are available on our higher plans; see Pricing.

Data backups

Customer data is backed up regularly so it can be restored in the event of a technical failure. Backups are protected with the same care as live data and access to them is restricted to authorised personnel.

Employee data privacy

When you use Qrew HR, your organisation decides what employee data is collected and how it is used. We process that data on your behalf to provide the service, and we do not sell it or use it for advertising. Our approach is aligned with India's Digital Personal Data Protection Act, 2023. Read the full details in our Privacy Policy.

• Least access: our own team accesses customer data only when needed to provide support or operate the service.
• Your data, your control: you can export your data, and request deletion when you stop using Qrew HR, as described in our Terms of Service.
• Documents with care: sensitive documents such as identity proofs and offer letters are stored in the employee document vault with role-based visibility.

Secure product practices

• Access to production systems is limited to the people who need it to run the service.
• Changes to the product are reviewed and tested before release.
• Third-party services we rely on to run Qrew HR are chosen with security and data protection in mind.
• Security issues reported to us are investigated and prioritised promptly.

What you can do to keep your account secure

Security is shared between us and you. A few habits make a big difference:

• Give each person their own login; never share admin accounts.
• Use strong, unique passwords, and use single sign-on if your organisation has it (see Integrations).
• Remove access for employees on their last working day as part of your exit checklist.
• Keep payroll and document access limited to a small group.
• Be careful with exported reports: store them securely and delete copies you no longer need.

Responsible disclosure

If you believe you have found a security vulnerability in Qrew HR, please tell us privately at support@qrewhr.com with "Security" in the subject line. Include a description of the issue, the steps to reproduce it and any relevant details. Please do not access or modify data that does not belong to you, and give us reasonable time to investigate and fix the issue before sharing it publicly. We will acknowledge your report and keep you updated on our progress.