SHA-256 hash chain
Each closed record is linked to the previous one with a cryptographic hash, and so is each evidence file. The Super Admin can verify the whole chain at any time.
Security and GDPR
Reliable records and data protected by design
Hours are the basis of every invoice. That is why integrity, privacy and access control are built into the core of Vahetus, not added later.
Integrity
How we protect every record
Several independent layers make any change to the hours detectable.
Insert-only history
Adjustments, flags, evidence and the audit log cannot be changed or deleted. The application uses a database user without those permissions, and database triggers block it even for the database administrator.
Audit log
Every administrative action is recorded with who did it, what they did and when: new users and projects, portfolio changes, password resets and every approval or rejection.
Always-online clock-in
There is no offline clock-in to be reconstructed later. If the connection drops, the shift closes on its own and is marked as interrupted.
Access
Everyone sees only what is theirs to see
- Role permissions checked on the server for every request
- Each account manager can only access the freelancers in their portfolio
- No public sign-up: only the Super Admin creates users
- Passwords stored only as hashes, never in plain text
- Signing out revokes that session on the server
- Resetting a password ends all of that person’s sessions immediately
- Sign-in attempt limits to slow down brute-force attacks
GDPR
Data protection with clear rules
Humanos Tech OÜ is an Estonian company subject to the General Data Protection Regulation.
Clearly defined roles
Your company is the controller of the data it enters into Vahetus and Humanos Tech acts as processor, under a data processing agreement signed with the contract.
Everyone’s rights
Each user sees their own data and can request deletion of their account from the application. Data is anonymised in line with legal retention periods.
A cookie-free website
This website does not use tracking, advertising or analytics cookies, and serves its resources from its own domain.
Does your security team have questions?
Write to us and we will answer your security or data protection team’s questions.
Write to us