Data security in Egalis

On Hetzner servers (data centres in Germany, EU), administered by us — not on shared infrastructure with uncontrolled third parties. The public website’s free tools run entirely in the visitor’s browser: the data you enter in them leaves the browser only when you submit a form (the offer request, results emailed to yourself, feedback, partnership requests).

The calculation engine never sees names or national ID numbers: in the calculations, employees exist only as their payroll ID plus sex (the only personal characteristic the indicators by sex need). If a company chooses to import names too (for day-to-day operation), they live in a separate table, encrypted with AES-256-GCM, visible exclusively to the owner, the HR administrator and the company’s consultant — and they never enter calculations, reports or legal exports.

The platform is multi-tenant with strict per-company isolation, demonstrated by automated isolation tests that run on every code change. Access is based on eight roles (owner, HR administrator, management approver, workers’ representative, team manager, employee, recruiter, consultant) — access control enforced by the platform on every page, not left to choice.

Every legally relevant action (import, evaluation, approval, report, answer to a request, deadline notification) is written to an append-only log. Immutability is enforced at the database level (a trigger rejects any UPDATE or DELETE), not by application convention — not even administrators can rewrite history.

• Passwords stored with scrypt (irreversible, salted hashing).
• Two-step verification (TOTP) mandatory for the roles that see individual salaries and identities (owner, HR administrator, consultant) and for platform administrators — with a 14-day grace period from the first sign-in, after which the company’s pages are locked until it is activated; optional for every other role. Activation issues single-use backup codes, for when a phone is lost.
• Rate limiting on authentication and public forms (anti brute-force).
• httpOnly sessions; strictly necessary cookies only (see the cookie policy).
• All traffic over TLS; administration ports closed to the public internet.

Full export (structured JSON) and permanent company deletion are functions in the application, available to the owner at any time — including after the subscription ends. Deletion removes all content data; the audit log is retained as legal evidence (it contains no salary data). Anonymising a single employee (the right to erasure) is also done in the application, person by person.

Daily backups of the entire server, kept for 7 days, with a documented restore procedure; a staging environment separate from production. The scheduler that sends deadline notifications has a health signal monitored by the operator, and processes touching legal deadlines are treated at maximum severity — the product’s promise is “you don’t miss deadlines”.

Egalis security is not a list of features but a management system organised along ISO/IEC 27001:2022:

• a formally assessed risk register with explicit acceptance thresholds;
• written, versioned policies: access control, cryptography, secure development, incidents, continuity, information classification;
• a Statement of Applicability covering all 93 Annex A controls, each with a status and evidence;
• a treatment plan with deadlines for the controls still open.

We do not yet hold an independent certification and do not claim otherwise — certification is planned for when customer scale demands it. The documentation (Statement of Applicability, policies) is available to customers on request under a non-disclosure agreement, and we complete security questionnaires based on it.