Security
Data security and privacy
You entrust us with your employees' HR data — PESEL numbers, passports, bank accounts. We take that seriously. Below, concretely, what we do to keep this data safe — without marketing platitudes.
Encryption of sensitive data
The most sensitive fields — PESEL, passport number, bank account number (including family members' PESEL) — are encrypted in the database with AES-256-GCM in an envelope model: each value gets its own key, and the keys are protected by a master key. Searching by PESEL works without decryption (blind index, HMAC). In practice: even access to the database itself does not reveal this data in readable form.
PESEL, passport and account numbers never reach the logs — neither the application's nor the server's.
Strict data separation between companies
Every company using DoPusk sees only its own data. The separation is enforced on every database operation — you cannot read another company's data by mistake. This rule is guarded by an automatic test that checks the completeness of the protection on every code change.
Audit log and document integrity
Data operations are recorded in an audit log. Every document has a checksum (SHA-256) and append-only versioning — an older version does not disappear, a new one is created. This is the foundation for the future fully electronic file: document integrity can be proven.
Electronic signatures
Documents signed with Profil Zaufany are verified cryptographically (PAdES) — the system checks whether the signature is valid and whether the document was altered after signing.
Privacy at the architecture level
- We host fonts ourselves — the browser sends no requests to external CDNs (e.g. Google Fonts), so data about your visits does not leak to third parties.
- No tracking cookies and no profiling — we use only essential files (session, language, theme). Visit statistics for the public pages are aggregate and cookie-free.
- Data stored in the EEA, transmission encrypted.
- The session is secured (cryptographically signed, httpOnly, expires after 8 h).
Your data is yours
Honestly about the limits
We are in open testing and continuously develop our safeguards. We do not promise things we have not yet implemented — this page describes the actual state, not plans. If you notice a problem or have a security question, write to us: Contact.