Security & trust

Your team's data stays yours

You trust us with salaries and ID numbers. Here is exactly how we keep them safe and separate — plain enough for HR, precise enough for your IT and legal reviewer.

Request our security pack See how we protect it

one app · many companiesisolated

Your company

Another company

Walled off by design · no shared view between companies

Four things we do with every record

These are not add-ons. They are how the product is built, for every company, on day one.

Full company isolation
Kelola is multi-tenant (one app serves many companies). Each company’s data lives in its own walled space. You never see another company’s data, and they never see yours.
Encrypted personal data
Sensitive fields — pay and ID numbers (called PII, personal data that identifies someone) — are encrypted at rest (scrambled on disk). A stolen file is unreadable.
Immutable audit log
Every change is written to an audit log (a change history no one can edit). It shows who did what, and when — so nothing quietly disappears.
Role-based access
People see only what their role allows (called role-based access). A manager sees their team; a staff member sees only their own record.

Hosted for Indonesia and Southeast Asia

Your data is kept for the region you operate in, not shipped to the other side of the world.

We host and process employee data for the Indonesia and Southeast Asia market. This keeps your records close to your team and helps you meet local data rules. Need the exact region and provider for a review? Ask us for the security pack.

Compliance and certifications

We tell you where we stand today — not where we hope to be. No inflated claims.

Aligned

UU PDP aligned

We follow UU PDP — Indonesia’s Personal Data Protection Law (Law 27/2022) — in how we collect, store, and process employee data.

On our roadmap

ISO 27001

We are not yet ISO 27001 certified (an international standard for managing information security). It is a planned step, and we build to its controls today.

Available

DPA on request

Need a DPA (data processing agreement — the contract that sets out how we handle your data)? Ask us and we will send it for your legal review.

Found a security problem? Tell us.

If you spot a weakness in Kelola, report it to us in private first. We read every message, we will not take legal action against good-faith research, and we will keep you updated on the fix.

security@kelola.example

Talk to us about security

Bring your reviewer. We will walk through isolation, encryption, and our audit log, and send the security pack for your records.

Talk to us about security Read the docs