Data security in Egalis

On Hetzner servers (data centres in Germany, EU), administered by us — not on shared infrastructure with uncontrolled third parties. The public website stores nothing: all free tools run entirely in the visitor’s browser.

The calculation engine never sees names or national ID numbers: in the calculations, employees exist only as their payroll ID plus sex (the only criterion the Directive permits collecting). If a company chooses to import names too (for day-to-day operation), they live in a separate table, encrypted with AES-256-GCM, visible exclusively to the owner and HR-admin roles — and they never enter calculations, reports or legal exports.

The platform is multi-tenant with strict per-company isolation, demonstrated by automated isolation tests that run on every code change. Access is role-based (owner, HR admin, management approver, workers’ representative, employee, recruiter) — access control the Directive requires, not an option.

Every legally relevant action (import, evaluation, approval, report, answer to a request, deadline notification) is written to an append-only log. Immutability is enforced at the database level (a trigger rejects any UPDATE or DELETE), not by application convention — not even administrators can rewrite history.

• Passwords stored with scrypt (irreversible, salted hashing).
• Two-step verification (TOTP) supported at sign-in.
• Rate limiting on authentication and public forms (anti brute-force).
• httpOnly sessions; strictly necessary cookies only (see the cookie policy).
• All traffic over TLS; administration ports closed to the public internet.

Full export (structured JSON) and permanent company deletion are functions in the application, available to the owner at any time — including after the subscription ends. Deletion removes all content data; the audit log is retained as legal evidence (it contains no salary data).

Daily backups of the entire server, kept for 7 days, with fast, well-rehearsed restores; a staging environment separate from production. Application errors are collected centrally, and processes touching legal deadlines are treated at maximum severity — the product’s promise is “you don’t miss deadlines”.

Egalis security is not a list of features but a management system organised along ISO/IEC 27001:2022:

• a formally assessed risk register with explicit acceptance thresholds;
• written, versioned policies: access control, cryptography, secure development, incidents, continuity, information classification;
• a Statement of Applicability covering all 93 Annex A controls, each with a status and evidence;
• a treatment plan with deadlines for the controls still open.

We do not yet hold an independent certification and do not claim otherwise — certification is planned for when customer scale demands it. The documentation (Statement of Applicability, policies) is available to customers on request under a non-disclosure agreement, and we complete security questionnaires based on it.