What it is
CorpHands keeps each company's data separate, shows each person only what their role needs, and records important changes in a log that cannot be edited. This page summarises the safeguards your IT and audit teams usually ask about.
CorpHands does not hold a formal security certification such as ISO 27001 or SOC 2 yet. If your IT team has a security questionnaire, contact us and we will answer it in full.
What you can use it for
- Sessions: sign-in cookies are HTTP-only and last up to 30 days; CorpHands stores only a hash of the session token. Changing your password signs out your other sessions, a password reset signs you out everywhere, and deactivating someone ends their sessions in your company at once.
- Passwords and rate limits: passwords are hashed with bcrypt. After 8 failed attempts for one email (or 40 from one network) sign-in is paused for 15 minutes. Password-reset, sign-up and single sign-on attempts are limited too.
- Perks PIN: merchants confirm a perk with a 6-digit staff PIN. Five wrong PINs for one card at one merchant lock it for 15 minutes, and 20 wrong PINs lock the merchant for an hour.
- Encrypted secrets: single sign-on client secrets, BambooHR keys and CSV tokens are encrypted with AES-256-GCM. API keys, invitation links, reset links and partner sign-in links are stored only as hashes.
- Append-only audit log: the database rejects any change to past entries, and each company's entries form a hash chain. Verify now on the Audit log page checks that none were changed, removed or inserted.
- Protected files: receipts, licences and photos are served only to admins of the same company; employees open only their own evidence files, and line managers those of their direct reports.
How to do it
Verify the audit log
- Open the Audit logGo to CSR workspace → Audit log (owners, CSR admins and auditors).
- Check the chainThe Audit chain card shows Intact with the number of entries verified, or Broken at #n. Select Verify now to run the check again.
- Keep the last hash elsewhereNote the Last hash in board minutes or an email to your auditor, or keep an Export CSV. A later chain with a different hash at that point has been rewritten.
Respond when someone leaves
- Deactivate the personOpen them in People, untick Active and save. Their sessions in your company end immediately.
- Review keys and partnersRevoke API keys they managed under Integrations, and deactivate any charity partner users who no longer need access.
Tips and good practice
- CorpHands does not monitor screens, keystrokes, apps, browsing or working hours. It is not a time-tracking or productivity tool.
- CorpHands does not track location continuously. It asks once at a QR check-in, with consent, and the employee can decline.
- CorpHands does not handle donations, card numbers or bank details. Your company pays charities directly.
- Use single sign-on (Enterprise) to apply your own multi-factor authentication and joiner-leaver controls to CorpHands.
- Addresses you configure for single sign-on and HR sync must use HTTPS, and CorpHands refuses to call private network addresses.
Questions
Can a CSR admin delete audit entries?
No. Nobody can edit or delete entries from the app. Deletion is possible only as part of closing an account, and any tampering outside CorpHands shows up as a broken chain.
Are uploaded SVG logos safe?
SVG files with scripts, event handlers, external links or embedded objects are rejected, and logos are served in a sandbox.
How is our data kept apart from other companies?
Every record belongs to one company, and every page, action, export and API call checks that the person or key belongs to that company.
Where can I read what CorpHands records?
See What CorpHands tracks and Privacy and consent.