Security & compliance
Your data, kept safe and in the UK
Empliora holds sensitive HR and immigration data, so security is built in, not bolted on. Here is how we protect it and stay accountable.
Data protection and UK GDPR
Empliora is built to align with the UK GDPR and the Data Protection Act 2018. Forge9X Ltd, which operates Empliora, is registered with the Information Commissioner's Office (ICO reference ZC188323). Our privacy policy sets out what we hold and why, and a Data Processing Agreement is available for employers who need one.
Where your data lives
Your data is hosted in UK data centres (London) and stays within the UK. It is encrypted in transit with TLS, and encrypted at rest. Right to work, visa and immigration documents are treated as sensitive and stored in secure, access-controlled file storage.
Access and accountability
Access is role-based: owners, HR managers and employees each see only what their role allows, and employees are mobile-only by design. Every meaningful action is written to a full activity log, with the user and time recorded, so there is always a clear trail of who did what.
Backups and resilience
Your data is backed up automatically with point-in-time recovery, on managed, redundant infrastructure. We monitor availability around the clock and publish it openly, so you can always see how the platform is performing rather than take our word for it.
Our sub-processors
Empliora runs on a small, trusted set of UK and EU-hosted providers: Supabase for the database and encrypted file storage, Vercel for application hosting, and Resend for transactional email. Each is bound by a data processing agreement, and we keep this list current.
Built for compliance work
Because Empliora exists to keep employers compliant, we build to current Home Office right to work and sponsor licence guidance, keep dated evidence for every check, and let you export an audit-ready pack for a Home Office or CQC visit.
Certifications and roadmap
We are transparent about where we are. Today, Forge9X Ltd is ICO-registered and Empliora is built to UK GDPR. We are working toward Cyber Essentials, with ISO 27001 on our roadmap as we grow. We do not claim certifications we have not earned.
- ICO registered (ZC188323)
- UK GDPR aligned
- Cyber Essentials (in progress)
- ISO 27001 (on roadmap)
Questions about security?
Procurement or security team need details, or a Data Processing Agreement? Get in touch and we will help.