Security at Justparity
How we protect your employees' pay data, what we have in place today, and how to report a vulnerability to us.
Last updated: 5 November 2026 · security@justparity.com
How your data is protected
- Each company kept separate: each company's data is kept apart from every other company's. The database enforces row-level access rules (Row-Level Security), and the server checks company and role before it shows or changes any data. The rules were reviewed and tightened in April 2026, and automated tests check that a user cannot see another company's data.
- Login: login with email and password via Supabase Auth. Repeated failed login attempts are slowed down.
- Encryption in transit: all traffic is encrypted with TLS 1.2 or later, and browsers are told to always use an encrypted connection (HSTS).
- Encryption at rest: the database and files are encrypted with AES-256 at Supabase.
- No open database: the database requires an access key and an encrypted connection, and access to data is governed by the row-level rules.
- Audit log: important actions are recorded in an audit log that neither users nor the platform itself can change. Entries are only deleted together with the company's account, and when a user is deleted, the record of who performed the action is cleared.
OWASP Top 10
The OWASP Top 10 is a well-known list of the ten most common security risks in web applications. The table shows what we have in place for each of them as of 5 November 2026.
| Risk | Status | What we have in place |
|---|---|---|
| A01 Broken Access Control | Addressed | Row-level rules, role checks on the server and an audit log |
| A02 Cryptographic Failures | Addressed | TLS 1.2 or later, AES-256 at rest |
| A03 Injection | Addressed | Parameterised database queries and input validation |
| A04 Insecure Design | Addressed | Secure defaults and a configuration check at start-up |
| A05 Security Misconfiguration | Addressed | Configuration check at start-up, HSTS and Content Security Policy |
| A06 Vulnerable and Outdated Components | Monitored | Automatic dependency updates (Dependabot) and npm audit |
| A07 Identification and Authentication Failures | Addressed | Throttling of repeated login attempts, and one-time links that link scanners cannot use up |
| A08 Software and Data Integrity Failures | Addressed | Signed session tokens and an audit log that cannot be changed. When a user is deleted, only the record of who performed the action is cleared |
| A09 Security Logging and Monitoring Failures | Addressed | Audit log, Supabase logs, uptime monitoring and alerts on denied access attempts |
| A10 Server-Side Request Forgery (SSRF) | Not assessed | Outgoing calls from the platform have not yet been reviewed as a whole for this risk |
Certifications
ISO 27001 and SOC 2
Long-term goals. We hold neither today, and no date has been set.
Assurance report
We have no external assurance report (such as ISAE 3000) today.
GDPR
We process personal data as your processor under a data processing agreement. Read more under GDPR and in the data processing agreement.
Security testing
In January 2026 we carried out an internal review and hardening of the platform. No external penetration test of Justparity has been carried out yet. Supabase has its own platform tested, but that test does not cover our code. Once an external test has been carried out, the report can be shared under a confidentiality agreement on request to security@justparity.com.
Retention and deletion
- While you are a customer: your data is available for as long as the agreement runs.
- When the agreement ends: personal data is deleted from the production environment under the rules in the data processing agreement.
- Right to erasure: employees can exercise their rights under Article 17 GDPR through their employer. If an employee contacts us directly, we forward the request to the employer. See GDPR.
- Audit log: the audit log cannot be changed or deleted, but when a user is deleted, the record of who performed the action is cleared. The log is kept for as long as the company's account exists.
Report a vulnerability
If you have found a vulnerability in Justparity, please report it to us before you tell anyone else about it:
How to report:
- Write to security@justparity.com.
- Describe the vulnerability, how it can be reproduced and what it could lead to.
- We confirm receipt within 48 hours and give you a status within 7 days.
- Please wait to make it public until it has been fixed (at most 90 days).
The time limits above (48 hours, 7 days and 90 days) apply to vulnerability reports. Personal data breaches are notified to you as controller under the data processing agreement, no later than 24 hours after we become aware of the breach, see clause 10.1.
We do not pay bounties for vulnerabilities found.
Sub-processors
The platform's database and server functions are located in the EU (Frankfurt). Some sub-processors may process data in the USA. This takes place under the EU-US Data Privacy Framework and the European Commission's standard contractual clauses. The full list with purpose and location is in Appendix B of the data processing agreement.
- Supabase: database, files and login (EU, Frankfurt)
- Netlify: website and server functions (the server functions run in the EU, Frankfurt)
- Google: emails from the platform (EU and USA)
- Slack: notification to our team about enquiries from the contact form
- Sentry: error monitoring, which can only send to Sentry's EU region (not switched on today)
Questions about security?
Write to security@justparity.com or use the form below.
Security enquiries
Write your enquiry here, or write directly to security@justparity.com if you want to report a vulnerability.