Skip to content

Security

Salary data deserves more than a password

Wola holds pay, loans and employment records. It is built so that one organisation's data can never be mistaken for another's, and so that what happened can always be shown.

Start your 30-day trial Read the questions
  • 30 days free
  • No card needed
  • Works alongside your payroll

One organisation's data can never be mistaken for another's

The separation is enforced by the database itself, not only by the application.

  • Every organisation's records carry its identity, and every request runs inside a transaction that names the organisation.
  • The database refuses to return another organisation's rows, even to the application's own database role and even if a mistake were made in the application code.
  • A write for another organisation is refused by the database too.
  • The separation is tested table by table, including a dedicated test for a trial trying to reach another organisation.

Signing in

Passwords are never stored, and a stolen password alone should not be enough.

  • Passwords are kept as Argon2id hashes. Sessions are stored hashed too.
  • Repeated failed sign-ins are limited per email address and per network address, which slows guessing and spraying.
  • A password reset link works once and expires, and using it ends every other session.
  • Two-step sign-in with an authenticator app, plus recovery codes. Your organisation can require it for the roles you choose, such as finance and administrators. The secrets are encrypted at rest.

Everyone sees only what their role needs

Wola does not show the same links to everyone, and it does not rely on hiding a link to protect a page.

  • One table of privileges decides what each role can open. The server checks it on every page and every action.
  • An employee sees their own record, a line manager sees their own team, and the full book is limited to the finance, HR, executive and audit roles you choose.
  • The auditor role can read everything and change nothing. Nobody on an approval chain can edit the chains.
  • Every action that moves money checks the role again on the server and writes an audit entry.

A record nobody can rewrite

The audit trail and the ledger are append-only, so what you read later is what happened.

  • The application's own database role cannot delete audit rows, and cannot change or delete payroll runs.
  • A correction is a new entry that says what it fixes, never an edit.
  • Sign-in attempts, changes to people and roles, approvals and every money action are logged with who and when.

When someone from Wola looks

Wola's own staff have less access than you might expect, and what they do is written down.

  • The platform console shows Wola's operators an organisation's list of people and its totals, never an individual's salary or loan.
  • Operators must use two-step sign-in. A platform sign-in can never unlock an organisation, and the reverse.
  • Every organisation an operator opens is recorded in an append-only log of operator activity.

Consent and privacy, on the record

People are told what is held about them, and what they agreed to is kept.

  • Everyone accepts the organisation's privacy notice before using Wola. It is recorded per person, organisation and version.
  • A borrower accepts the exact loan terms in the app. The terms are stored with a fingerprint and the date, and cannot be changed afterwards.
  • Trial organisations are for practice data. A trial that has ended is deleted after 60 days.

In the browser, and on the way there

  • The site is served over HTTPS only, and browsers are told to insist on it.
  • Other sites cannot embed Wola's pages in a frame, which protects the sign-in page from being overlaid.
  • Source maps are not shipped, so the original source of the application is not handed to every visitor.

What we have not done, and what that means

A page like this is only worth reading if it says where the edges are.

This is our own review of how Wola protects data, not an independent audit, and Wola has not yet had an outside penetration test. An independent review is on our list.

Nothing makes software impossible to break. The protections above are layered so that one mistake is not enough to expose another organisation's data.

The people who run the database can, as with any system, technically read what is stored in it. We limit that: the administrative database connection is not on any server, the console shows operators only totals and lists of people, and what they open is recorded.

Questions from your IT or security team are welcome: write to joshua.kyayi@synsify.africa.

Keep reading

See Wola with your own people in it

Start a free trial in minutes with a sample company, or bring your own staff list. Your team can try every role before anything real is loaded.

Start your 30-day trial Book a demo