Security
Your data. Our responsibility.
OrgaPlus processes HR, payroll and finance data. That's why we treat security as a foundation, not a feature — sober, verifiable, and free of marketing promises.
Six pillars
Encryption
Data is encrypted in transit (TLS) and at rest. Particularly sensitive fields are additionally protected at field level with AES-256-GCM.
Hosted in Switzerland
Your data is hosted in Switzerland and never leaves it. That simplifies your obligations towards employees and customers under the Swiss nDSG.
Access control & audit log
Role-based permissions separate admins, branch managers and employees. Security-relevant actions are recorded in an audit log.
Two-factor authentication
Administrative accounts can be protected with 2FA (TOTP) and backup codes. Passwords are hashed with bcrypt — never stored in plain text.
Backups
Regular automated backups protect against data loss. Deletion is controlled — deactivated accounts lose access immediately.
Responsible disclosure
Security researchers can reach us through a documented reporting channel (security.txt). Reported vulnerabilities are fixed with priority.
Tested, not just claimed
The platform underwent a comprehensive white-box security assessment in 2026. Every identified finding has been remediated and verified.
- All 50 findings from the 2026 penetration test fixed and verified
- Sessions via httpOnly cookies — tokens are not readable by browser scripts
- Rate limiting on all public endpoints to prevent abuse
- Prices and amounts are computed server-side — the client is never trusted
- Security processes aligned with ISO 27001 principles (no certification claimed)
Compliance
nDSG and GDPR
- Data processing under the Swiss Data Protection Act (nDSG); GDPR principles are respected
- Your data is yours: export anytime, including after the contract ends
- Access and deletion requests are supported — contact: privacy@orgaplus.ch
- Clear processing boundaries: OrgaPlus processes your data solely to provide the service
Found a vulnerability?
We take every report seriously. Our contact details for security researchers are published in machine-readable form — we respond in German, English, French or Italian.
View security.txtSecurity FAQ
Questions about security?
We'll show you how roles, the audit log and data export work in a demo.