Security at Humio
Humio holds some of the most sensitive data a company has: salaries, IC numbers, bank accounts and medical leave. This page sets out plainly how we protect it, and how to tell us if you find a problem.
Stored in Singapore, on AWS
Your data is held on Amazon Web Services in the Asia Pacific (Singapore) region. We run no servers of our own.
Encrypted in transit and at rest
Every connection to Humio uses HTTPS, and file storage refuses any request that is not encrypted. The database and file storage are encrypted at rest by AWS.
Backed up continuously
The database can be restored to any moment in the last 35 days, and a file that is replaced or deleted can be recovered for 30 days. Production data cannot be deleted by a mistaken release.
Each company kept apart
Every request is checked on our servers against the company the signed-in person belongs to, record by record. Nothing in the app alone decides what someone can see.
Access by role
Employees see their own records. What anyone else sees, from payroll to audit history, depends on the permissions their role is given. Pay runs can require a second person’s approval, and whoever submits a run can never approve it.
Private files, short-lived links
Receipts, documents and photos are private. Each one opens through a link that expires within minutes. Clock-in photos are deleted after 90 days, and payslips sent by email can be password protected.
Every change recorded
The audit trail records who changed what, and when, with identity and bank numbers masked. It is kept for 7 years by default, and no one can edit or delete an entry from the app.
Strong passwords
Passwords need at least eight characters, mixing upper and lower case, numbers and symbols. Sign-in never reveals whether an email has an account. When someone leaves, an Admin can switch off their sign-in while keeping their records.
Not used to train AI
Receipt scanning and face matching run on AWS. We have opted out of AWS using that content to improve its services, so your receipts and faces are not used to train anyone's AI.
Your data under PDPA
We process personal data on your behalf under Malaysia’s Personal Data Protection Act. The Privacy Policy sets out what we hold, why, and for how long.
Reporting a vulnerability
If you believe you have found a security issue in Humio, email xqteoh@thenuviotech.com with what you found and how to reproduce it. We will reply within three working days and keep you posted until it is fixed.
Please test only against your own account, do not access or change other people’s data, and give us a fair chance to fix the issue before telling anyone else.