Security and GDPR
Your team's data, handled with the care it calls for
Salaries, NIF (tax number), IBAN, sick leave. We know what's in Selfcare. This page says where the data lives, who sees it and what we do with it, with no promises we can't show.
Where the data lives
- The application runs on Vercel, in the Frankfurt region.
- The database is PostgreSQL on Neon, hosted in the EU (Frankfurt).
- Files (photos, payslips, expense receipts) are kept in Cloudflare R2, with jurisdiction restricted to the EU.
- All traffic goes through HTTPS, and the connection to the database requires TLS.
Who gets in
- You sign in with email and password, or with your Google account.
- Then a second step confirms it's you: a 6-digit code sent to your email or, if you prefer, the code from your authenticator app or a passkey. It's mandatory for everyone, and it's only skipped on a device you choose to trust, for 30 days.
- For the day you lose your phone, there are single-use recovery codes, and the email code is always available.
- Passwords are never stored: we store only a bcrypt hash.
- Each person signs in with their own account. Removing someone's access is one click in the company settings.
Who sees what
- Each role (owner, HR, manager, employee, accountant) sees what that role allows, and nothing more.
- Colleagues and team leaders never see NIF, NISS (social security number), IBAN or salaries. That data stays with those who manage the company and payroll, and with the employee themselves.
- Expense receipts and ajudas de custo (per diem) receipts open only through routes that confirm the session and the permission of the person requesting them.
- Each company is separate from the others: having several companies on one login combines the access, not the data.
What gets recorded
- Actions that change data go into an audit log: who did it, what and when.
- The log is append-only: entries can't be edited.
GDPR
- The data is hosted in the European Union.
- We don't sell data or use it for advertising.
- In GDPR terms, your company is the controller of its employees' data, and Selfcare processes it on your company's behalf, as processor.
- The data is yours: you export employees in CSV, in the same format the importer reads, and mapas (payroll reports) and other reports come out in open formats.
- To measure use of the site and the application we use PostHog, hosted in the EU. We don't use advertising pixels.
Do you have a security question, need a document for your data protection officer or want to exercise a right over your data? Write to ola@selfcare.work.
Ask us the hard questions
In the demo we answer whoever handles security and data protection in your company, with the product open in front of you.