Security you can explain to your board.
Ayekoo holds pay, ID numbers and reviews. Here is exactly how we protect them.
Each company is walled off
Row-level security in the database keeps every company's records apart. The app connects with a database role that can't switch it off, so a bug in a page can't show one company's data to another.
Sensitive numbers encrypted
Ghana Card, passport, bank account and Mobile Money numbers are encrypted with AES-256-GCM before they're stored. Screens show the last four digits; revealing the full number is a separate, logged action.
People see only what they should
Permissions are set per section and per field. Colleagues see a work profile, managers see their team, payroll sees pay. Nobody gets everything by default.
An audit trail for sensitive actions
Revealing ID numbers, changing pay or personal details, exporting reports and payroll files, and changing settings are all recorded with who and when.
Two people for every pay run
The person who prepares a payroll run can't approve it. A second person has to check it before payslips and bank files go out.
Anonymous means anonymous
Anonymous survey answers are stored without the person's name, and results are hidden for groups under five. Policy help questions are kept without who asked.
Safe sign-in
Passwords are stored as one-way hashes, repeated sign-in attempts are slowed down, and every page is served over HTTPS. Staff without email sign in with a one-time code by text message.
AI is off until you switch it on
If your company turns on the AI assistant, only the text needed for each request is sent to Anthropic, with no ID or bank numbers, and it isn't used to train their models.
Ghana's Data Protection Act
Your company is the data controller for its people. Ayekoo is your processor: we only use the data to run Ayekoo for you, and our data processing agreement sets that out under Act 843. Data Protection Commission registration: [DPC registration number].
Where your data lives
Hosted by [Hosting provider] in [Hosting location], with regular backups. The providers we rely on are listed on our subprocessors page.
Found a vulnerability?
Email security@ayekoo.app. We reply to every report and won't take action against good-faith research.