Your people’s data, protected
How i-Swipe HR Suite keeps employee data safe, and how we help you meet the Nigeria Data Protection Act 2023 (NDPA), the NDPC’s General Application and Implementation Directive 2025 (GAID) and similar laws in Ghana, Kenya, South Africa, Uganda, Rwanda and Egypt.
Security built into the product
Each company kept separate
Every record belongs to one company, and every query is limited to it.
Encrypted
HTTPS for everything in transit. Passwords stored only as bcrypt hashes; bank account numbers, NIN, RSA PIN, TIN and two-step sign-in secrets encrypted with AES-256-GCM.
Strong sign-in
Two-step sign-in, Google and Microsoft sign-in, your own SAML identity provider, and SCIM so leavers lose access at once.
Least access
Roles decide what each person sees. Pay and personal details stay with HR and finance, and payroll needs two different people to approve.
Full audit log
Every change is recorded — who, what, when and from where — for you to review and export.
Protected files
Uploads are checked by type, private documents go only to people allowed to see them, and spreadsheets are protected against formula injection.
Your rights and your staff’s rights
See and correct
Staff see their own data and ask for corrections from My Data & Privacy in the app.
Download or erase
Staff can download their data or ask for it to be erased. HR tracks each request to the legal deadline.
You stay in control
Your company is the data controller; i-Swipe is the processor and uses the data only to run the service. We never sell it or use it for advertising.
AI only if you choose
AI features are off unless your company turns them on. Only the text needed is sent, and it is never used to train AI models.
When you leave, you can export everything first. We then delete your data within the period in our agreement.
Data processing agreement
The NDPA expects a written agreement between you and any company that processes your staff data. Ours is ready to print and sign. HR admins who are signed in get it with their company’s name and details filled in.
Sub-processors
Services that may see customer data. Only the ones switched on for this installation are listed; we give 30 days’ notice before adding a new one.
| Who | What for |
|---|---|
| Hosting provider (your i-Swipe server) | Runs the app and stores the database and filesWhere the server is located |
| Email delivery (SMTP provider) | Sends sign-in codes, payslip and approval emailsVaries by provider |
| Paystack | Card and bank payments for your subscription (no employee data)Nigeria |
| Anthropic | AI HR assistant and AI writing help, only when your company switches them on. Not used to train AI models.United States |
| Africa’s Talking | USSD self-service sessions, only for staff who link their phoneKenya / Nigeria |
| proxycheck.io | Checks whether a clock-in comes from a VPN, proxy or data-centre network. Receives only the internet address of the clock-in; answers kept 7 days.United Kingdom |
Report a security issue or ask a privacy question
Email [email protected] with what you found and the steps to reproduce it. We reply within 2 working days and keep you updated until it is fixed.