How we protect your data

Infrastructure & hosting

Growee runs on Amazon Web Services in the European Union, inheriting AWS's physical security, network protection and compliance certifications (ISO 27001, SOC 1/2/3, and more) for the underlying infrastructure.

• Tenant isolation. Every company gets a dedicated subdomain, and every database query is automatically scoped to your company. Cross-tenant access is prevented at the framework level, not by convention.
• Segregated environments. Production is separated from development and staging, and production access is limited to authorized personnel with individual credentials.
• Inherited compliance. Payments run exclusively through Stripe (PCI DSS Service Provider Level 1); Growee never stores or transmits card data.

Encryption in transit & at rest

• In transit. All connections to Growee are encrypted with TLS. Plain HTTP is not served.
• At rest. Databases and file storage are encrypted at rest on AWS.
• Application-level encryption. High-sensitivity values, such as OAuth tokens and connected integration credentials, are additionally encrypted at the application level before they reach the database.
• Passwords. User passwords are hashed with bcrypt. They are never stored or logged in plain text, and staff cannot read them.

Access control & authentication

• Role-based access control. Built-in roles (Admin, HR, Manager, Employee, Collaborator) plus fully custom roles with granular, per-feature permissions. Sensitive data such as salaries, contracts, evaluations and invoices is restricted to authorized roles, enforced server-side on every request.
• Authentication options. Email and password, or sign-in with Google and Microsoft (OAuth 2.0). Two-factor authentication via email verification codes can be enabled for your company.
• API access. The REST API uses scoped bearer tokens (Laravel Sanctum) that can be revoked at any time. API requests respect the same role and tenant boundaries as the UI.
• Internal access. Growee staff access to production data is limited to named engineers, used only for support and operations, and our team is trained on data handling and confidentiality.

Data retention, export & deletion

• Retention. We keep your data for as long as your account is active. We do not retain it for unrelated purposes, and we do not sell it or use it to train AI models.
• Export. Administrators can export company data (employees, documents, time and leave records) as downloadable archives at any time, at no cost. There is no lock-in and no long-term contract.
• Deletion. Account deletion is self-serve and protected by an email confirmation code. It permanently removes your company's data, including uploaded files, from production systems. Residual copies in encrypted backups expire as backups rotate.

Subprocessors

We use a small set of vetted service providers to run Growee. Each is bound by a data processing agreement, and transfers outside the EU are covered by Standard Contractual Clauses. The Products column shows which Growee modules (Core HR, CRM, Knowledge Base, Hiring) rely on each provider, so you only need to review the ones for products you actually use. This list is kept current on this page and referenced in our DPA.

Backups, monitoring & incident response

• Backups. Databases are backed up automatically every day, and backups are stored encrypted. Restores are part of our operational procedures.
• Monitoring. Application errors, background jobs and system health are continuously monitored, with alerting to the engineering team.
• Incident response. We have established procedures to identify, contain and mitigate security incidents. If an incident affects your data, we notify you and, where required, the supervisory authority within GDPR's 72-hour window.

Application security practices

• Independent penetration testing. Growee has been penetration tested by Cyber Threat Defence, an independent cybersecurity firm, and received their Certificate of Trust. Findings are remediated and re-verified.
• Secure development. Every change goes through code review and a CI pipeline with automated tests and static analysis before it can reach production.
• Dependency management. Third-party dependencies are reviewed and updated regularly, and security advisories for our stack are tracked and patched.
• Vendor due diligence. Before engaging any third-party provider we review its security posture and data protection compliance, and we bind it with a data processing agreement.

Responsible disclosure

We welcome reports from security researchers. If you believe you have found a vulnerability in Growee, email security@growee.ai with enough detail for us to reproduce the issue (affected URL or endpoint, steps, impact).

Safe harbor: we will not pursue legal action against researchers who act in good faith, follow this policy, and avoid privacy violations or service disruption.