How WatheeqaHR protects your company's data
You're trusting WatheeqaHR with employee and payroll data — here is exactly how it's isolated, protected, and minimized, in plain language. This page summarizes the same facts as our full Privacy Policy.
Six things that are true about your data today
Full company isolation
Every record is tied to your company's ID. No other company on WatheeqaHR can see or query your data, ever.
Encryption in transit
All traffic runs over HTTPS/TLS. Passwords are hashed with bcrypt — never stored in plain text, and not viewable by anyone, including our own team.
Role-based access inside your company
Owner, Admin, HR, Accountant, and Viewer roles control exactly what each person can see and do — for example, an HR user does not see salary figures without an explicit permission.
An audit trail for sensitive actions
Salary changes, attendance edits, and payment records are logged with who did it, when, and why — reversals are documented, never silently deleted.
We collect less than you'd expect
We never store passport or ID card images, full passport/ID numbers, or biometric fingerprint/face templates. Attendance is imported from your device's export file — WatheeqaHR never connects to a biometric device directly.
Hosting & backups
Hosted on Amazon Web Services (AWS), currently in Frankfurt, Germany, within the European Union. Backups are transferred securely and kept for a limited period.
You own it — we're the processor, not the owner
Download your company's data as Excel/CSV whenever you want, no need to ask us first.
Cancel your subscription and your company's data is permanently deleted within a maximum of 90 days.
For employee data, your company is the data controller and WatheeqaHR is the data processor — employee data requests should go to your company first, and we help you fulfil them.
Your data and your employees' data are never sold to third parties and never used for advertising.
Security & privacy, straight answers
Do you sell or share our data with third parties?
No. We only share data with the providers required to run the service itself — AWS for hosting, Amazon SES for email, and Twilio/Meta for WhatsApp if your company enables it. None of them use your data for their own purposes.
Where is our data physically hosted?
On AWS in Frankfurt, Germany, within the European Union, under appropriate safeguards for data leaving the country. We do not claim any other hosting location.
Do you store biometric data from our attendance devices?
No. We import attendance punch times (in/out) from the Excel or CSV export file your device produces. We never store fingerprint or face templates, and we never connect directly to a biometric device.
What happens to our data if we cancel?
You can export everything as Excel/CSV at any time. After cancellation, your company's data is permanently deleted within a maximum of 90 days.