Comply4HR Trust Center

Outlines Comply4HR's plans to maintain critical business functions and restore IT systems following a major disruption. Includes Recovery Time Objective (RTO) of 4 hours and Recovery Point Objective (RPO) of 1 hour. Regular DR drills are conducted quarterly to validate recovery capability and ensure operational resilience.

Governs the use of personal devices (phones, laptops, tablets) to access Comply4HR systems and data. Defines minimum security requirements including screen lock, encryption, and approved MDM enrollment. Covers acceptable use, data segregation, and remote wipe rights upon departure.

Governs how Comply4HR collects, processes, stores, and deletes personal data of users, employees, and third parties. Aligned with India's Digital Personal Data Protection Act, 2023 and global best practices. Covers data minimization, consent, retention schedules, and data principal rights including right to access, correction, and erasure.

Defines controls to prevent unauthorized access, transfer, or leakage of sensitive business and client data. Covers monitoring of data in use, in motion, and at rest. Includes classification of data types, approved transfer channels, and consequences of policy violation. DLP tools are deployed across email, cloud storage, and endpoints.

Mandates the use of approved cryptographic standards across all Comply4HR systems. All data at rest is protected using AES-256 and data in transit is secured via TLS 1.2/1.3. Covers key management lifecycle, approved algorithms, prohibited ciphers, and responsibilities of system owners for maintaining encryption controls.

Establishes procedures for identifying, reporting, containing, and recovering from security incidents. Defines roles of the Incident Response Team (IRT), escalation paths, and communication protocols with affected parties. Target breach notification timeline is within 72 hours of discovery in line with regulatory requirements.

The foundational policy defining Comply4HR's approach to protecting information assets from all threats — whether internal or external, deliberate or accidental. Covers access control, asset management, cryptography, physical security, supplier relationships, incident management, and business continuity. All employees must acknowledge this policy annually.

The complete Comply4HR IT Policy Framework bundle containing all individual policies, procedures, and supporting documents. This compressed archive (ZIP) is intended for compliance auditors, enterprise clients, and internal governance reviews requiring a comprehensive view of Comply4HR's security posture.

Sets mandatory requirements for creating, protecting, and managing passwords across all Comply4HR systems. Includes minimum complexity rules, rotation schedules, prohibition on password reuse, and guidance on using approved password managers. MFA is required for all privileged accounts and remote access.

Defines the process for identifying, evaluating, testing, and applying security patches to all Comply4HR systems and software. Critical patches are applied within 48 hours of release; high-severity patches within 7 days. Covers operating systems, applications, databases, firmware, and network devices.

Governs physical access to Comply4HR offices, server rooms, and IT equipment. Includes visitor management, access card controls, CCTV monitoring, clean desk policy, and secure disposal of physical media. Data center hosting is covered under Tier 3 facility SLAs with biometric access and 24/7 on-site security.

Establishes Comply4HR's framework for identifying, assessing, treating, and monitoring information security risks. Uses a risk register to track active risks, owners, treatment plans, and residual risk ratings. Risk assessments are conducted annually and triggered by significant changes to systems or the threat landscape.

Integrates security into every phase of Comply4HR's software development process — from requirements and design through coding, testing, deployment, and maintenance. Mandates security code reviews, SAST, DAST, and penetration testing before production release. Covers all internally developed and customized applications.

Sets minimum security and compliance requirements for all third-party vendors and service providers who access Comply4HR systems or process client data. Requires security assessments before onboarding, contractual data processing agreements (DPA), and annual reviews. Covers cloud providers, payroll processors, legal firms, and IT service partners.

Describes how Comply4HR collects, uses, and protects information gathered through the comply4hr.com website including contact forms, cookies, and analytics. Covers third-party tools, user rights, cookie consent management, and contact details for privacy-related enquiries. Published publicly on the website.

Defines how long Comply4HR retains different categories of data and the secure processes for deletion and disposal. Retention schedules are aligned with legal, regulatory, and contractual obligations under Indian law. Covers employee records, client data, financial records, audit logs, and backup media.