Security & compliance
Your data, kept safe and in the UK
Empliora holds sensitive HR and immigration data, so security is built in, not bolted on. Here is how we protect it and stay accountable.
Data protection and UK GDPR
Empliora is built to align with the UK GDPR and the Data Protection Act 2018. Forge9X Ltd, which operates Empliora, is registered with the Information Commissioner's Office (ICO reference ZC188323). Our privacy policy sets out what we hold and why, and a Data Processing Agreement is available for employers who need one.
Where your data lives
Your data is hosted in UK data centres (London) and stays within the UK. It is encrypted in transit with TLS, and encrypted at rest. Right to work, visa and immigration documents are treated as sensitive and stored in secure, access-controlled file storage.
Access and accountability
Access is role-based: owners, HR managers and employees each see only what their role allows, and employees are mobile-only by design. Every meaningful action is written to a full activity log, with the user and time recorded, so there is always a clear trail of who did what.
Backups and resilience
Your data is backed up automatically with point-in-time recovery, on managed, redundant infrastructure. We monitor availability around the clock and publish it openly, so you can always see how the platform is performing rather than take our word for it.
Built for compliance work
Because Empliora exists to keep employers compliant, we build to current Home Office right to work and sponsor licence guidance, keep dated evidence for every check, and let you export an audit-ready pack for a Home Office or CQC visit.
Certifications and roadmap
Security here has two layers. The infrastructure Empliora runs on is independently certified by our providers, and Empliora itself is ICO-registered and built to UK GDPR. We are transparent about where we are, and we do not claim certifications we have not earned.
- ICO registered (ZC188323)
- UK GDPR aligned
- Cyber Essentials (assessment underway)
- ISO 27001 (on roadmap)
Certified infrastructure
Empliora runs on UK-hosted providers that hold the leading independent security certifications. Their certificates and reports are available in their trust centres.
Application hosting and compute, in London (lhr1).
SOC 2 Type 2, ISO 27001:2022, GDPR DPA
Database, authentication and encrypted file storage, in London (eu-west-2).
SOC 2 Type 2, ISO 27001, HIPAA
Our sub-processors
The third parties that may process data on our behalf. Each is bound by a data processing agreement, and we keep this list current.
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication and encrypted document storage | United Kingdom (London) |
| Vercel | Application hosting and compute | United Kingdom (London) |
| Resend | Transactional and notification email delivery | EU / United States |
| AI provider (Groq / Anthropic) | Document reading and drafting assistance, when AI features are used | United States |
| Ideal Postcodes | UK address lookup (postcode search only) | United Kingdom |
| Companies House | Company verification (company number lookup only) | United Kingdom |
Questions about security?
Procurement or security team need details, or a Data Processing Agreement? Get in touch and we will help.