Payroll is some of the most sensitive data a business holds. Here is how we protect it.
Every connection to Nobicel uses HTTPS. Passwords are hashed with bcrypt and never stored in plain text, and sign-in sessions use signed cookies that page scripts cannot read.
Administrators and accountants sign in with TOTP two-factor authentication by default, and any workspace can require it for every user.
Company, accountant, insurance and employee roles each see only what they need. Permissions are enforced on the server, not just hidden in the interface.
Payroll approvals, employee changes, loans and sign-ins are written to an append-only audit log, attributable to a person and a timestamp.
Payouts are designed to run through licensed payment providers, so bank and wallet credentials never touch our servers, and every payout is recorded in a ledger with its own reference.
Every record is scoped to your organisation, and cross-tenant access is checked on every request.
If you believe you have found a vulnerability in Nobicel, we want to hear from you before anyone else does. Email support@nobicel.com with the subject “Security report” and enough detail to reproduce the issue. We will acknowledge reports within two business days, keep you informed as we fix them, and will not pursue good-faith researchers who respect user data and give us reasonable time to respond.
Nobicel is in early access. The controls described above — hashed credentials, two-factor authentication, server-side authorisation, tenant isolation and audit logging — are built into the platform today. Live connections to GRA, SSNIT, HMRC and payment providers, and our production hosting and backup arrangements, are being rolled out with our first customers. We will document them here as they go live.
For security questionnaires, a walkthrough of our controls, or anything not covered here, contact hello@nobicel.com.