Log in Contact phone
+1 844 991 0513
Get Started Now

Security at Factorial

Here at Factorial, we are very aware of the trust placed on us by over 3,000 companies. That’s why we know how important security is for them.

Keeping our customers' data protected at all times is our highest priority. This security overview provides a high-level overview of the security practices put in place to achieve that objective. Have questions or feedback? Feel free to reach out to us at security@factorial.co Our security.txt can be accessed here

Cloud infrastructure

All of our services run in the cloud. We don’t host or run our own routers, load balancers, DNS servers, or physical servers. Our service is built on Amazon Web Services. They provide strong security measures to protect our infrastructure and are compliant with most certifications. You can read more about their practices here: AWS

Network level security monitoring and protection

Our network security architecture consists of multiple security zones. We monitor and protect our network, to make sure no unauthorized access is performed using:
  1. A virtual private cloud (VPC)
  2. A firewall that monitors and controls incoming and outgoing network traffic.

Data encryption

  1. Encryption in transit: All data sent to or from our infrastructure is encrypted in transit via industry best-practices using Transport Layer Security (TLS). You can see our report at SSLLABS
  2. Encryption at rest: All passwords are encrypted using battled-proofed encryption algorithms in the database.

Data retention and removal

  1. We retain your data for a period of 90 days after you close your account or request for removal. All data is then completely removed from the servers. Data will be remain on the backup 30 days after that.
  2. Every user can request the removal of usage data by contacting support.
  3. Read more about our privacy settings at https://factorialhr.es/en/privacy.

Business continuity and disaster recovery

Factorial backs up all the data on a daily basis and it retains the backups for 30 days. Hence, our RPO is 1 day. Is worth noticing that we have high availability with RDS Multi-AZ. This means that in order to have data loss we would need both availability zones to have an incident at the same time (an extremely unlikely scenario). If that were to happen, it’s very easy for us to recover a backup. Our RTO is 15 minutes.

Application security monitoring

  1. We use technologies to monitor exceptions, logs and detect anomalies in our applications.
  2. We collect and store logs to provide an audit trail of our applications activity.
  3. we use tools like https://semgrep.dev/ for static analysis to find bugs and enforce code standards.
  4. We use GitHub security tools to get alerts when a dependency has a vulnerability. The security team applies the security patches routinely.
  5. We run a yearly pentest backed by a third-party vendor. Our last pentest was done by https://cobalt.io/. We will happily share the results with you if you need them.

Secure development

We develop following security best practices and frameworks (OWASP Top 10, SANS Top 25). We use the following best practices to ensure the highest level of security in our software:
  1. We review our code for security vulnerabilities
  2. We regularly update our dependencies and make sure none of them has known vulnerabilities
  3. We rely on yearly third-party security experts to perform penetration tests of our applications.

User protection

  1. We protect our users against data breaches by monitoring and blocking brute force attacks.
  2. Single sign-on (SSO) is available using Google, Microsoft and Linkedin account.
  3. Permission-based access control is offered on all our accounts and allows our users to define permissions.
  4. We use AWS Cognito, so by default we support multi-factor authentication.

Compliance

We’re compliant to the General Data Protection Regulation (GDPR). The purpose of GDPR is to protect the private information of EU citizens and give them more control over their personal data. Contact us for more details on how we comply to GDPR.

Payment information

  1. All payment instrument processing is safely outsourced to Stripe which is certified as a PCI Level 1 Service Provider. We don’t collect any payment information and are therefore not subject to PCI obligations.

Over 60,000 companies have already used our human resources software

Our commitment to the GDPR

In Factorial we are committed to the European General Data Protection Law (GDPR). This means that all our users can access all their data at any time and exercise their right to cancel.
Read more about GDPR
Link to next page

Certificates and security protocols

All our customer data is stored on the servers of Amazon Web Services (AWS) in Germany, a set of web services in the cloud that guarantee maximum security. Companies like Netflix or Airbnb rely on AWS to manage the data of millions of users.
The Amazon Web Services data center is defended by three physical layers of security. Likewise, the facilities are protected against impacts and are only accessible through a non-transferable personal card and pin.

Frequently Asked Questions

These are some of the most frequent questions from our users.
  1. What do you do with my company's information?
    All the data collected in Factorial will help us to streamline and simplify the management of your employees, improve decision making and reduce structural costs by managing the different aspects of your company's work.
  2. Will you share my information with third parties?
    No, Factorial vows to not to sell or pass the data of your company or employees to third parties.
  3. Who can access my data?
    All your information and documents are only accessible through your username and password. It is very important that you do not share this information with anyone!
  1. Can I delete my data whenever I want?
    Yes, you can exercise any right of access, rectification, cancellation and opposition of the data that you have entered in Factorial at any time.
  2. Can Factorial sign my GDPR form?
    Protecting your data is our primary concern. Please see our Privacy Policy, Cookie Policy, Data Security Statement, Legal Statement, as well as our Terms of Service to learn more about our commitment to and protocol for protecting your data which is compliant with GDPR regulation for EU customers. Aside from the information outlined on those pages, we won’t be able to complete extended questionnaires or sign one-off agreements with individual users. For any additional questions, please contact us.
Factorial logo
A software that was created with the goal of solving the problems of Human Resources in small and medium-sized businesses.
Download our new Android app Download our new iOS app
  • AICPA SOC logo
  • SSL 256-bit logo
  • us

    United States

    • Do you want to know more about Factorial?

    Request a demo and see how we can help your company

    Request demo