Security
Cyber & information security policy
How Forge9X Ltd protects the information held in Empliora. This is the summary policy; a fuller version and a Data Processing Agreement are available to customers on request.
1. Purpose and scope
This policy sets out how Forge9X Ltd protects the information held in Empliora. It applies to all Empliora systems, data and people with access to them. Empliora holds sensitive personal data, including immigration and payroll information, so these controls are treated as mandatory rather than optional.
2. Access control
Access follows least privilege. Each account receives only the access its role requires, enforced in the database with row-level security so one company can never read another's data. Administrative access to production is limited to named individuals and reviewed regularly. Accounts are removed promptly when no longer needed.
3. Authentication and passwords
Passwords must be at least 12 characters and include lowercase, uppercase and numeric characters; a symbol is encouraged. Passwords are stored only as salted hashes and are never visible to us. Re-authentication is required before a password is changed. Credentials are never shared, and multi-factor authentication is being rolled out to administrative and employer accounts.
4. Encryption
All data is encrypted in transit using TLS, and encrypted at rest on the underlying infrastructure. Connections are forced to HTTPS by strict transport security. Right to work, visa and identity documents are held in private, access-controlled storage and served only through short-lived, proxied links that never expose the storage location.
5. Hosting and data residency
Empliora runs on UK-hosted infrastructure. Application compute runs in London on Vercel, and the database, authentication and file storage run in London on Supabase. Both providers hold SOC 2 Type 2 and ISO 27001 certification. Data stays within the UK other than the limited, named sub-processors listed on our security page.
6. Monitoring and audit logging
Every meaningful action in the application is written to an activity log with the user, time and IP address, giving a clear and tamper-evident trail. Platform availability is monitored continuously and published openly on our status page.
7. Backups and resilience
Data is backed up automatically with point-in-time recovery on managed, redundant infrastructure. Restores are possible to a chosen moment in time, which limits the impact of accidental deletion or corruption.
8. Secure development
Changes are reviewed before release, dependencies are kept current, and secrets are held in managed environment configuration, never in source code. Security headers, including content security policy on public pages and strict transport security everywhere, are applied by default.
9. Incident response
If a personal data breach is identified, we contain and investigate it immediately, assess the risk to individuals, and where the law requires it notify the Information Commissioner's Office within 72 hours and inform affected customers without undue delay. We keep a record of incidents and the lessons taken from them.
10. Data retention and deletion
Personal data is kept only for as long as there is a lawful basis to hold it, in line with our privacy policy and the employer's instructions as data controller. On request, and subject to legal retention duties, data is securely deleted.
11. Supplier and sub-processor management
We use a small, named set of sub-processors, each bound by a data processing agreement. The current list is published on our security page and kept up to date. New sub-processors are assessed for their security posture before use.
12. Governance and review
This policy is owned by Forge9X Ltd and reviewed at least annually and after any significant change or incident. Forge9X Ltd is registered with the Information Commissioner's Office (reference ZC188323).