Built for Jamaica's Data Protection Act.
Payroll data is some of the most personal information a business holds. Ovrilo was designed around the Act from the first line of code, not fitted to it afterwards.
What the Act asks for, built in.
The Act sets standards for how personal data is collected, kept, secured and shared. Here's how Ovrilo meets them for you and your employees.
Clear roles
You decide what happens to your employees' data; we process it only to run Ovrilo for you, as our data processing statement sets out.
A data protection officer
Named in our Privacy notice and reachable at dpo@ovrilosystems.com, for you and for your employees.
Breaches reported within 72 hours
If a breach touches your workspace, we tell you within 72 hours with what we know, and report to the Information Commissioner as the Act requires.
Rights answered on time
Requests to see, correct or object are answered within 30 days, or 21 days for objections.
Sub-processors on notice
We list who helps us run Ovrilo, and give owners 30 days' notice before adding one, so you can object.
Deleted means deleted
90 days after you leave, your database, files, backups and encryption keys are deleted. Only invoices are kept, as the law requires.
We don't sell personal information, we don't use it for advertising, and we don't send marketing email. The only emails Ovrilo sends are about your account: sign-in, invoices, the notifications people choose and changes to our terms.
Encrypted on the way, encrypted at rest.
Layers that each stand on their own, so no single slip exposes your people's details.
Encrypted in transit, everywhere
Every connection to Ovrilo, from browsers, Clock Stations, phones and the connector, is encrypted with TLS. Browsers are told never to connect without it.
A key for every workspace
Each workspace has its own database and its own encryption keys. One customer's key can never open another's data.
AES-256 on sensitive fields
Contact details, identifiers, dates of birth and pay rates are encrypted with your workspace's key, using AES-256-GCM, before they're stored.
Keys that are locked away too
Workspace keys are themselves stored encrypted, apart from the data they protect.
Found without being read
Encrypted details like email addresses are matched with keyed fingerprints, so looking someone up doesn't mean decrypting everyone.
Passwords never stored
Only a one-way hash of each password is kept. Nobody at Ovrilo can see yours.
When a workspace is deleted, its keys are destroyed with it, so anything encrypted with them can't be read again, even from an old backup.
The right people, and only them.
- Roles scoped to teams: team leads see their own teams, payroll their own pay groups
- Two-factor sign-in and passkeys for everyone in your workspace
- Our staff use a separate Control Room with mandatory two-factor or passkeys
- Support steps in only with permission, for a limited time, and the owner is told
- Every Control Room action goes into an audit log that can't be edited
- Clock Station PINs are locked out after repeated wrong guesses
Backed up every night.
Nightly backups
Every workspace, every night, kept daily for 14 days and then weekly for 8 weeks.
Off site and encrypted
Backups are stored away from the servers, with a provider that encrypts everything at rest.
Restore one, not all
A single workspace can be restored on its own, without touching anyone else.
Nothing changed quietly
Edits to punches keep the original and record who made them and why.