Security

Your data stays yours

Hours, absences, sick leave, quotes, drawings: Équipora handles sensitive data. It is designed to protect it, on your premises as well as on ours.

Two-factor authentication (2FA)

Everyone can enable it in their profile with an authenticator app (Google Authenticator, Microsoft Authenticator, FreeOTP…), with 10 backup codes.

  • The administrator can make it mandatory: for administrators and HR, managers, or everyone
  • Lost phone: HR resets it from the employee record

Encryption

The most sensitive data is encrypted on disk, and all traffic goes over HTTPS.

  • Absence supporting documents (sick notes) encrypted
  • Two-factor authentication secrets, calendar links and time clock QR codes encrypted
  • Passwords hashed (PBKDF2), never stored in plain text
  • HTTPS mandatory in production, HSTS

Protected accounts

  • Account locked for 15 minutes after 10 wrong passwords or codes
  • Same response time whether or not the account exists: accounts cannot be guessed
  • Protected sessions (HttpOnly, SameSite cookies), CSRF protection, rate limiting
  • Roles and responsibilities: everyone only sees what concerns them
  • Separate customer portal: a customer cannot access any other page

Traceability

  • Log of sensitive actions: time record corrections, approvals, viewing of supporting documents…
  • Time record corrections always logged, with their author
  • CSV exports protected against formula injection

Hosting

In France or on your premises

You always know where your data is.

On your own server

Équipora installs on a Linux (VM or LXC container) or Windows server in your company. Your data stays with you: only the licence, updates and error reports go through the publisher's server.

  • A single native executable, no runtime to install
  • The initial setup is only accepted from your own network
  • Published on the Internet behind an HTTPS proxy, if you open the customer portal
  • Licence possible without Internet access (file or USB key)

Hosted by the publisher

Équipora Cloud runs on servers located in France [À COMPLÉTER : hébergeur et ville du centre de données], administered by the publisher.

  • One instance per company
  • Daily backups
  • Security updates installed without delay
  • Retrieve your data at any time

Backups and updates

Nothing gets lost

A database in a single file: easy to back up, easy to restore.

  • Automatic database backup before every update
  • Download a backup from the Updates menu
  • Compatible with your usual backups (VM, Proxmox, copy of the data folder)
  • Updates signed by the publisher, verified before installation
  • Installation overnight or when the administrator chooses

Frequently asked questions

Where is my data stored?

Installed on your premises: on your server, in the Équipora data folder. Hosted by the publisher: on our servers in France. In both cases, you can retrieve a full copy of your database.

Is Équipora GDPR compliant?

Équipora helps you comply with the GDPR: role-based access, encrypted medical documents, a log of who viewed what, data hosted in France or on your premises. You remain the controller of your HR data; we act as a processor for the hosted offering.

What happens if my subscription ends?

You keep your data. Installed on your premises, it stays on your server; hosted, we provide you with a copy of your database.

How do I report a security vulnerability?

Write to us from the contact page. We handle reports as a priority and publish fixes in the release notes.