Security — ZoHCM

Your company's data is isolated in the database

Every company's records are separated by Postgres row-level security, in addition to the checks the application makes. Each request runs as a role that can see only its own company's rows, so a mistake in application code cannot quietly expose another company's data. Resellers are isolated from each other the same way: a partner sees only the companies it created.

Sign-in that resists guessing and reuse

Accounts lock for 15 minutes after five failed sign-ins. New passwords must be at least 10 characters with upper and lower case, a number and a symbol, and are checked against known data breaches before they are accepted. A password someone else chose for you has to be changed at first sign-in. Sign-in errors are worded so they do not reveal whether an email is registered.

Two-factor sign-in, and control of your sessions

Anyone can add an authenticator app (TOTP) as a second step. From your profile you can sign out every other browser or device that is signed in as you, and signing out removes that browser's notification subscription.

Roles decide who sees what

Access is split between the platform owner, partners, Company Admins, staff granted specific working rights, managers and employees. Permissions are checked on the server on every request, not only hidden in the menu, and managers are held to their own team's scope.

POSH complaints stay confidential

The Sexual Harassment of Women at Workplace Act requires confidentiality. ZoHCM enforces it per request: a Company Admin sees nothing about a complaint unless they are currently an active Internal Committee member. Remove someone from the committee and their access ends on the next request.

An audit trail you can filter and export

Changes are recorded in an audit log with who, what and when. Admins can filter it by route, failed requests and date range, and download the filtered trail as a CSV; the download is itself recorded. A partner sees only the entries for its own companies.