We take security
As seriously as you do.
HR and sales data is among the most sensitive data a company holds — employee records, salary information, deal values, customer contacts. Here's exactly how Horilla protects it.
Encryption
GDPR
SOC 2 Type II
Audit logs
Security built into every layer
Not bolt-on. Horilla's security model is designed into the data architecture, not applied after the fact.
Encryption at rest & in transit
All data stored in Cloud instances is encrypted at rest using AES-256. All data in transit uses TLS 1.3. Database backups are encrypted with a separate key. No plaintext data on disk.
Role-based access control
Granular permission matrix: employee, manager, HR admin, company admin, and superadmin roles. Each role has explicit read/write permissions per module. Custom roles available on Enterprise.
Complete audit logging
Every create, read, update, and delete action is logged with timestamp, user ID, IP address, and changed values. Audit logs are immutable and exportable. Retention: 1 year on Cloud, unlimited on Enterprise.
Multi-tenant data isolation
Every company's data is isolated at the query level via Horilla's multi-tenant company manager. Cross-company data access is architecturally impossible at the ORM layer, not just by policy.
GDPR & data privacy
Data subject access requests (DSAR) can be fulfilled via the admin panel. Right to erasure is supported. Data processing agreements available. Regional data residency: EU, US, APAC.
Session & authentication security
Session tokens use HttpOnly, Secure, SameSite=Strict cookies. CSRF protection on all forms. Password hashing via PBKDF2-SHA256. MFA (TOTP) available on Cloud and Enterprise plans.
XSS & injection prevention
All model fields are validated via has_xss() before save. Django ORM prevents SQL injection. All user input is escaped in templates. CSP headers set on Cloud deployments.
Security advisory process
We triage all reported vulnerabilities within 72 hours. Critical issues get a fix within 7 days and a coordinated disclosure. We maintain a public security advisory history on GitHub.
Dependency scanning
Automated Dependabot alerts on all third-party Python and JavaScript dependencies. GitHub Actions CI runs Bandit (Python static analysis) and npm audit on every pull request.
Where we stand
We're transparent about our compliance status — including what's in progress and what we don't yet support.
| Standard / Regulation | Status | Scope | Notes |
|---|---|---|---|
| GDPR (EU General Data Protection Regulation) | Compliant | Cloud & Self-hosted | DPA available; data residency in EU region |
| India IT Act / DPDP 2023 | Compliant | All deployments | Built-in consent management; data localization |
| UAE PDPL (Personal Data Protection Law) | Compliant | All deployments | Consent flows and right-to-erasure supported |
| SOC 2 Type II | In progress | Cloud only | Target audit completion: Q3 2026 |
| ISO 27001 | Planned | Cloud only | Roadmap item after SOC 2 completion |
| HIPAA | Not applicable | — | Horilla is not a healthcare product. No PHI processed. |
| PCI DSS | Not applicable | — | Horilla does not store or process payment card data. |
Responsible disclosure
Found a security issue in Horilla? We want to hear from you. Email us at the address below with a clear description of the vulnerability, steps to reproduce, and the potential impact. We'll acknowledge within 72 hours, triage within 7 days, and credit you in the advisory if you'd like.
We ask that you don't publicly disclose the issue until we've had a reasonable opportunity to fix it (typically 30 days for critical issues).
Security is a shared responsibility
When you self-host Horilla, you own the infrastructure security. This includes keeping your server OS and Python runtime patched, configuring firewalls and network access policies, setting up TLS certificates, and managing database access. We provide security advisories and patched releases — you apply them to your instance. The Horilla docs include a production deployment hardening guide.
Horilla Cloud removes this burden entirely — our team handles OS-level patching, TLS, and database security. Cloud customers receive patches automatically, typically within 24 hours of a security release.
We're happy to discuss
Security reviews, penetration test reports, and DPA signing are all available for Enterprise customers. Contact our team.