How we look after your workforce data

There are no passwords to leak. People sign in with a one-time email link that expires after 10 minutes, or with a Google, Microsoft or Apple account. A business can also use its own identity provider through single sign-on.

Who must use a second factor

• Workspace admins, payroll officers and anyone whose role can change pay.
• LoggerIQ staff with platform access.
• Anyone who turns it on for themselves. Once on, every new session must pass it.

The second factor is an authenticator app (time-based one-time codes), with ten single-use backup codes for a lost phone. Repeated wrong codes lock code entry for a while.

Step-up for sensitive actions

Some actions need a second factor entered in the last 10 minutes, even inside a signed-in session: viewing or changing a bank account number, an admin opening someone’s tax file number declaration, importing data from a previous system, exporting a whole workspace, turning on sensitive modules and changing your own MFA settings. Each of these is written to the records log.

Sessions use secure, HTTP-only cookies. Anyone can see their signed-in devices, sign one out or sign out everywhere.

In transit: every connection uses HTTPS and browsers are told never to connect without it.

At rest: the database and file storage are encrypted by our providers. On top of that we encrypt the most sensitive fields ourselves, with AES-256-GCM, before they are stored. Someone with a copy of the database still cannot read them.

A per-workspace key means one workspace’s key never opens another’s data. Tax file numbers have a key of their own, so nothing that can open a bank number can open a TFN. Bank and wallet numbers are shown masked to the last four digits everywhere.

Names, work email addresses, timesheets and check-in answers are not encrypted at the field level, because the workspace needs them to run. They are protected by the provider’s encryption at rest and by access control.

Your workspace records live in a managed database in Australia (Sydney). Sign-in emails, alerts and text messages are sent from Australia. Other parts of the service run on providers whose networks operate in the United States and other countries.

The named list of sub-processors is provided under our data processing agreement. Ask security@loggeriq.io for a copy. Card details go straight to the payment provider and never reach us.

AI does two jobs in LoggerIQ and neither decides pay, approves anything or grades a person.

• Reading a receipt. When someone snaps a receipt on an expense claim, the image is sent to an AI model to read the total, tax, date and merchant. The person checks the result before submitting.
• Summarise, on request. In Virtual HR an admin can ask for a short written note about one person’s read. Only the label, the evidence lines and counts are sent: never the person’s name and never what they wrote in a check-in. A workspace can ask for at most 20 a day and each note is deleted after 7 days.

Both run on an AI service provided by our cloud infrastructure provider, on its global network. The provider does not use this content to train AI models. We do not train models on customer data either.

Flags on clock entries, the Virtual HR read and the repeated check-in check are rules-based. They run in our own code and explain themselves in plain English, so a person can see why something was flagged and answer it.

Location is read when someone clocks in or out. While they are clocked in, presence checks confirm they are still on site. Precise coordinates are kept from those checks only for people who have agreed to share live location. Nothing is collected off the clock.

Precise coordinates are encrypted and are cleared after 90 days. A trip route is shown to a manager only if the driver was told before the trip that it would be. The privacy policy has the detail and the surveillance notice template helps employers tell their people first.

• Every record belongs to one workspace and every query is scoped to it. Tests check that no query crosses from one workspace to another.
• Permissions come from each person’s role (admin, manager, area manager, payroll officer, auditor, employee, reception, kiosk) and are enforced on the server, not only hidden in the screen.
• Managers see the people in their scope. A manager never sees a tax file number.
• Auditor access is read-only and ends on a set date.
• Changes to hours, pay, leave and sensitive records are written to a records log that is kept for seven years. Opening someone’s bank number or TFN declaration in full is logged, without the number.

Scheduled jobs delete or clear data on the timetable below every day. Pay and HR records are kept for the period employers must keep them.

When a workspace closes, it stays read-only for 30 days so an admin can export everything. After that the workspace and its stored files are deleted automatically and its admins are emailed a deletion certificate. Only the records the law requires an employer to keep are kept, sealed in an encrypted archive for the statutory period. A person can also delete their own account: their name and contact details are removed and the pay records they appear in keep only an anonymised reference.

The database provider keeps a continuous history of changes, so the database can be restored to an earlier point in time after a mistake or an incident. Uploaded files are kept on redundant storage.

These are targets, not guarantees. We review them as the service grows.

LoggerIQ is covered by the Notifiable Data Breaches scheme under the Privacy Act 1988. If we suspect a breach, this is what happens.

1. Contain itStop the access or the leak and keep the evidence.
2. Assess it, quicklyWork out whether it is likely to cause serious harm. The law allows at most 30 days for this; we aim to finish much sooner.
3. Tell affected customersEmail the admins of every affected workspace within 72 hours of confirming their data was involved, with what we know and what to do.
4. Notify the regulator and the people affectedIf it is an eligible data breach, notify the Office of the Australian Information Commissioner and the affected individuals as soon as practicable.
5. Fix the cause and report backShare what changed so it cannot happen the same way again.

The OAIC explains the scheme at oaic.gov.au.

If you think you have found a security problem in LoggerIQ, email security@loggeriq.io with the steps to reproduce it. Our security.txt says the same.

What we ask

• Test only against your own account or a trial workspace you created.
• Do not access, change or keep other people’s data. If you reach some, stop and tell us.
• No denial of service, spam, social engineering or physical attacks.
• Give us a reasonable time to fix it before you share it publicly.

What we commit to

• Acknowledge your report within 2 business days.
• Keep you updated until it is fixed and credit you if you would like.
• Not pursue legal action for research that follows this policy in good faith.

We do not run a paid bug bounty.

There is no public status page yet. If LoggerIQ seems slow or down, contact support and we will tell you what we know.

• We secure the platform: encryption, workspace isolation, access to production, retention, backups and breach response.
• You decide who you invite and which role they get, tell your people about location features before you turn them on and look after data once it is exported from LoggerIQ.