HR system security checklist

• Employees read only themselves, managers their reporting subtree, HR the records of their scope, payroll the pay fields; every query filters by org and applies column groups by role; compensation reads are access-logged.

• Payroll preparation, approval and release are separate people; pay changes need a second approver; releasing a run needs step-up auth and cannot be done by its preparer.

• National ids, bank details, DOB and health or disability data are encrypted at column level with per-tenant keys, masked in UI and logs, and excluded from exports unless the payroll role requests them; special-category data lives in a separate restricted table.

• Detect ghost employees (no time or leave activity), bank detail changes just before pay, duplicate bank accounts across employees, and pay changes by their own approver; flagged items block release until reviewed.

• Resumes and contracts are type- and size-validated, scanned, and parsed in a sandboxed worker; filenames are never trusted and links are signed.

• Hiring features record structured reasons, never rank candidates on protected attributes, and any automated scoring is advisory, explainable, and reviewable by a human before a decision.

• Payroll and employment law: Wage, overtime, leave and termination rules differ by jurisdiction and change often; rule packs encode them as data, but the employer or payroll provider is responsible for correctness and filing. The app does not file taxes.
• GDPR and employee data (applies to EU employees): Employee data needs a lawful basis, DPIA for monitoring, retention limits and access rights; candidate data should be deleted or anonymised after a stated period.
• Pay transparency and equal pay (applies to US states, EU, UK): Pay transparency laws require salary ranges in postings and gender-pay reporting in some jurisdictions; the compensation history supports reporting.
• Hiring fairness and automated decisions (applies to any automated screening or scoring): Automated employment decision tools face bias-audit and notice rules (for example NYC Local Law 144, EU AI Act high-risk); keep humans in the decision.
• Record retention: Payroll and time records are retained for years (commonly 3-7); retention overrides erasure for those records.

• payslip pdfs per org month: capped renders per organisation per month.
• careers applications per day: per-opening and per-tenant daily application ceiling; over the cap submissions are refused.
• email per org day: daily notification ceiling per organisation, fails closed.
• storage gb per org: per-tenant quota for resumes and payslips.

Forge64 gives every app its own Postgres database and runs a quality gate that flags unauthenticated writes and secrets in client code before you see the app. It does not replace your own testing, and it holds no third-party security certification today.

This is a reference design for the category, not a promise that every item is generated today. Built-ins such as background jobs, file uploads and search are rolling out; email sent from your app is coming soon, so anything here that needs it is something you add yourself for now.

• Sign in as two different users and try to open each other's records by changing the id in the address.
• Submit each form with an empty value, a very long value and a script tag, and check the result.
• Call each write endpoint without signing in and check that it refuses.

What is the biggest security risk in an HR system?

Employees read only themselves, managers their reporting subtree, HR the records of their scope, payroll the pay fields; every query filters by org and applies column groups by role; compensation reads are access-logged.

Does an HR system have compliance obligations?

Payroll and employment law: Wage, overtime, leave and termination rules differ by jurisdiction and change often; rule packs encode them as data, but the employer or payroll provider is responsible for correctness and filing. The app does not file taxes. This is a starting point, not legal advice.

Will Forge64 certify my app as secure?

No. Forge64 holds no third-party security certification today and does not certify apps. The checklist is a way to test your own app.

• How to build an HR system
• HR system architecture
• Example prompt for an HR system
• HR system scaling checklist
• Often combined: accounting system
• Often combined: approval workflow app
• All app types