How Leave Balance Protects Employee Data: Encryption and Security Overview

Employee leave data includes personal information, medical records, salary details, and sometimes disciplinary information. Protecting this data is not optional — it is a legal requirement under GDPR, the Australian Privacy Act, and most data protection regulations worldwide. Leave Balance implements security at every layer: data encryption in transit and at rest, access controls, audit logging, and infrastructure security.

This article explains the security measures that protect employee data in Leave Balance. It is written for IT administrators, compliance officers, and anyone responsible for evaluating the security of HR tools.

Key Takeaways

• All data is encrypted in transit (TLS 1.3) and at rest (AES-256)
• Access is controlled through RBAC, SSO/SAML, and session management
• Leave Balance maintains SOC 2 Type II compliance and GDPR data processing agreements

How Leave Balance Protects Employee Data

Encryption in Transit

All communication between your browser, the Leave Balance mobile app, and our servers is encrypted using TLS 1.3. This is the current industry standard for transport layer security. Every request — from login to leave request submission to API calls — travels over an encrypted connection.

TLS 1.3 provides:

• Forward secrecy: each session uses a unique encryption key, so a compromise of one key does not expose other sessions
• Authentication: the server certificate is verified by your browser, preventing man-in-the-middle attacks
• Performance: TLS 1.3 handshakes are faster than older versions, adding no perceptible latency

Encryption at Rest

All data stored in Leave Balance databases is encrypted at rest using AES-256 encryption. This includes:

• Employee personal information (names, email addresses, phone numbers)
• Leave requests, balances, and histories
• Medical leave reasons and supporting documents
• Manager comments and approval notes
• Audit trail records

The encryption keys are managed through a key management service (KMS) and are rotated regularly. No Leave Balance employee has access to the raw encryption keys.

Data Processing

Leave Balance processes data in encrypted memory environments. Data is decrypted only during active processing and is re-encrypted immediately after. No leave data is written to unencrypted storage or logged in plaintext.

Access Controls

Role-Based Access Control (RBAC)

Every user in Leave Balance is assigned a role that determines what data they can see and what actions they can perform. See our RBAC guide for detailed role configurations.

Single Sign-On (SSO)

Leave Balance supports SAML 2.0 SSO, letting you enforce your organisation’s authentication policies — including MFA — for Leave Balance access. See our SSO setup guide for configuration details.

Session Management

• Sessions expire after a configurable inactivity period (default: 30 minutes)
• Concurrent session limits prevent credential sharing
• Active sessions can be viewed and terminated from the user’s account settings
• Session tokens are rotated regularly and are invalidated on logout

API Security

• API keys are workspace-scoped with role-based permissions
• Keys can be rotated at any time without affecting other integrations
• Rate limiting prevents abuse (60-1,000 requests per minute depending on plan)
• All API requests are logged in the audit trail

Infrastructure Security

Hosting

Leave Balance is hosted on AWS (Amazon Web Services) infrastructure. AWS provides:

• SOC 2 Type II compliance
• ISO 27001 certification
• Physical security for data centres
• DDoS protection
• Automatic scaling and failover

Backup and Recovery

• Databases are backed up automatically with point-in-time recovery
• Backups are encrypted and stored in a separate geographic region
• Recovery time objective (RTO): 4 hours
• Recovery point objective (RPO): 1 hour

Vulnerability Management

• Regular automated vulnerability scanning
• Annual penetration testing by independent security firms
• Responsible disclosure program for security researchers
• Dependency updates tracked and applied promptly

Compliance

GDPR

Leave Balance provides:

• Data Processing Agreement (DPA) for all customers
• Data residency options (EU, AU, US)
• Right to erasure: full data export and deletion on request
• Data minimisation: only necessary data is collected and retained
• Breach notification within 72 hours

Australian Privacy Act

• Leave Balance complies with the Australian Privacy Principles (APPs)
• Data is processed and stored in compliance with Australian data sovereignty requirements
• Employee data is not transferred overseas without appropriate safeguards

SOC 2 Type II

Leave Balance maintains SOC 2 Type II compliance, covering:

• Security: access controls, encryption, and monitoring
• Availability: uptime SLA and disaster recovery
• Confidentiality: data handling and access restrictions

Best Practices for Customers

• Enable SSO with MFA. Use your identity provider’s MFA policy for Leave Balance access. This adds a critical security layer beyond password protection.
• Limit HR Admin roles. Only team members who need full access should have HR Admin roles. Use Manager and Employee roles for everyone else.
• Review access quarterly. Check who has access and remove it for terminated employees. The audit trail helps you verify access patterns.
• Use the API with care. API keys carry the same permissions as human users. Store them securely, rotate them regularly, and limit their scope.
• Report security concerns. If you notice unusual activity in your Leave Balance account, contact support immediately. We investigate all security reports.

FAQ

Is Leave Balance GDPR compliant?

Yes. Leave Balance provides a Data Processing Agreement (DPA) for all customers, supports data residency in the EU, and implements the technical and organisational measures required by GDPR.

Where is employee data stored?

Employee data is stored on AWS infrastructure in the region closest to your workspace configuration. Options include US (Virginia), EU (Frankfurt), and Australia (Sydney). Data does not leave the configured region.

Can I export all employee data?

Yes. Leave Balance provides a full data export feature that generates a machine-readable file containing all employee records, leave data, and configuration. This supports GDPR’s right to data portability.

What happens if there is a data breach?

Leave Balance notifies affected customers within 72 hours of confirming a breach, as required by GDPR. The notification includes the nature of the breach, the data affected, and the steps being taken to address it.

Does Leave Balance use AI to process employee data?

Leave Balance uses rule-based processing for leave calculations and accruals. No employee data is used to train AI models. AI-assisted features, if any, process data within the encrypted environment and do not transmit data to external AI services.