How we protect your data

Sunday People holds salaries, bank details, PAN and identity documents. This page says exactly what we do to protect them, and where we haven't finished yet. It's written for HR heads, founders, and the IT or security team reviewing us.

Last reviewed 7 November 2026

Your data stays yours

You can take your records out whenever you like, as Excel or PDF files.

Leave requests, leave balances, attendance, who is out, and the attendance and leave report.
The audit log, assets, check-ins and skills.
For people with payroll access: the payroll register, bank transfer files, payslip PDFs, and Form 130 and Form 138 data.

Downloads of leave, attendance and payroll files are recorded in the activity log, with who downloaded them.

There isn't yet a single download of every record and document in one file. If you need one before you leave, write to us.

Encrypted where it matters

We encrypt the most sensitive fields ourselves before they're saved, with AES-256-GCM and a fresh random value for each one. They're only ever stored encrypted:

Employees' bank account numbers and PAN, including the copies kept with each payslip.
Your company's salary account number.
Landlords' PAN on rent declarations.
Tax certificate PDFs, which carry PAN and salary.
The secret behind each person's two-factor sign-in.
Connections you set up: Slack workspace tokens, and the keys used to import from your previous HR tool.

Bank account numbers and PAN show on screen with only the last four characters. People who manage payroll can reveal a full number, and every reveal is recorded. Chat tokens use a different key from payroll data, and if the payroll key is ever missing, payroll stops rather than saving anything unencrypted.

Other records, such as names, salaries, leave and attendance, aren't encrypted field by field. They're protected by the access rules below, and by our providers' encryption of the storage they sit on: DigitalOcean encrypts its managed databases at rest, and Amazon S3 encrypts every file it stores. Files are never public. Each one opens through a link that works for 15 minutes, made only after a permission check.

In transit

Browsers and the mobile apps connect over HTTPS to Cloudflare, which sits in front of our servers. Our servers connect to the database, Amazon S3 and Amazon's email service over encrypted connections.

The hop from Cloudflare to our application server isn't encrypted yet, and we're moving it to HTTPS. Until that's done, we don't describe Sunday People as encrypted in transit end to end. Biometric attendance devices send punches over plain HTTP, because their firmware supports nothing else.

Isolated per company

Every company's data is kept in the same database, separated by company. Our code enforces the separation on every request.

Which company you belong to is read from your account on our server each time you use Sunday People. Nothing your browser or phone sends can change it.
Our code limits what it reads and changes to that company. Files are stored under your company's own folder, and that is checked before any link to a file is made.
Automated tests try to reach another company's records in several areas and expect to be refused.

The database doesn't enforce the separation by itself yet. The protection is in our application code.

Who can see what

Sunday People has five fixed roles. Each one is a set of permissions, and every admin action checks the permission it needs.

Roles and what they can do
Role	What it can do
Owner	Everything, including payroll, billing and making other owners.
Admin	Everything except payroll, billing, field staff locations and performance improvement plans, unless an owner gives them access.
HR manager	Day-to-day HR: people, onboarding, documents, letters, leave, attendance, resignations, reviews, policies, assets and exports. Can be limited to some departments or clients.
Viewer	Sees people, leave, attendance, assets, expenses and reports, and changes nothing. Can be limited to some departments or clients.
Employee	Their own records. Managers also see their direct reports' requests, through the reporting line.

Sensitive data needs its own access

Sensitive data and who can see it
Data	Who can see it
Identity documents and home addresses	Owners and admins. HR managers and viewers only when given sensitive data access.
Payroll: salaries, payslips, bank details	Owners. Admins, HR managers and viewers only when given payroll access, and HR managers and viewers only if they also see everyone and have sensitive data access. Viewers can only look.
Salary band amounts	Only people who can see payroll.
Performance improvement plans	Owners. Admins and HR managers only when given access. Managers see their own reports' plans.
Potential ratings and the 9-box	Owners and admins. HR managers only when given talent access. Never viewers.
Field staff locations	Owners. Admins, HR managers and viewers only when given access. Managers see their own teams. Never Sunday staff.

Sunday staff

Our platform view shows, for each company, counts and dates of activity, and each account's name, email, role and when they were last seen. It never shows leave reasons, document contents, salaries or payroll figures.
Sunday staff accounts belong to Sunday's own organization. There's no screen in the product that puts them inside your company.
Sunday staff can add an owner to your company, for example if your only owner has left. When they do, it's recorded in your activity log as made an owner by Sunday, and the new owner is emailed.
The product never shows field staff locations to Sunday staff.
Engineers who run the service can reach the production database to operate it. That access isn't recorded in your logs yet.

A record of who did what

Decisions go into an audit log at the moment they're made, in the same database transaction as the decision itself.

Approvals, rejections and cancellations of leave, attendance corrections, expenses, resignations and documents, plus payroll runs, settlements, appraisals, improvement plans, sign-ins, two-factor changes and more.
Each entry says who did it, what, when, and from which app: web, iPhone or Android.
The log can only be added to. The database refuses changes and deletions, except when a deleted company is erased after its 30 days.
Owners and admins can read and download it. Payroll entries show only to people who can see payroll, and never include amounts.

A separate activity log records role and access changes, exports, downloads of sensitive documents, and sign-in being turned on or off for someone.

Backed up

The database runs on DigitalOcean's managed PostgreSQL service, which takes a backup every day and can restore the database to any point in the last seven days.

Uploaded files are stored in Amazon S3, which keeps each file on several devices across separate data centres in the region.

Where your data lives

Your records and files are stored in India. Some services that carry traffic or report errors are global, so we don't say that no data ever leaves India.

Where each kind of data is stored or processed
What	Where
Database and application server	DigitalOcean, Bangalore, India
Uploaded files: documents, photos, letters	Amazon S3, Mumbai, India
Emails we send	Amazon SES, Mumbai region, then each recipient's own email provider
Traffic between you and our servers	Cloudflare's global network
Error reports and performance monitoring	Sentry and New Relic, United States

Error reports and performance traces can include technical details of a request. If you connect Slack or Microsoft Teams, sign in with Google or Microsoft, import from another HR tool or pay through Razorpay, the data each of those needs goes to that service.

There are no passwords to leak or reuse.

People sign in with a 6-digit code sent to their work email, which works for 10 minutes and allows 5 tries, or with their Google or Microsoft work account.
Two-factor sign-in uses an authenticator app, with ten one-time backup codes. Five wrong codes in a row lock two-factor for 15 minutes. A device can be trusted for 30 days.
Owners and admins set your company's sign-in rules: turn off any sign-in method, limit Google and Microsoft sign-in to your email domains, and require two-factor for owners, admins and anyone with payroll access, or for everyone.
Sending and checking codes is rate limited, per email address and per network address.
A sign-in lasts up to seven days. Everyone can see where they're signed in and sign out their other devices. Sessions end at once when someone leaves, loses access, has sign-in turned off or has two-factor reset.
The iPhone and Android apps keep the sign-in in the phone's secure storage.

Letters anyone can verify

Every letter Sunday People issues carries a document ID and a QR code.

Anyone holding the letter, such as a bank or a future employer, can scan the code or type the ID to see whether the letter is valid, who it was issued to and when, and the issued PDF. HR sees each time a letter is checked and can withdraw it. IDs are random, so they can't be guessed.

Privacy and monitoring

In the Sunday People web app, analytics start only after you accept the cookie notice, and you can change your choice later. Names, emails, amounts, comments and record IDs are never sent to analytics, and no user ID is set.
Errors are reported to Sentry, performance is watched in New Relic, and an outside check calls our service every five minutes and alerts the team through PagerDuty if it fails.
Our privacy policy is at hellosunday.ai/privacy.

Leaving Sunday

Export what you need first. Then:

If a paid plan ends, or a payment fails and seven days of grace pass, nothing is deleted. The account is paused: owners and admins can still reach the subscription page, and everything is there when you choose a plan or move to the free plan for up to 10 employees. Exports aren't available while the account is paused, so export before you cancel.
We never delete your data on our own. It stays until an owner deletes your company in Sunday People, or you ask us to. Then we erase your records and uploaded files within 30 days, except the invoices we issued to you, which we keep as the law requires. Database backups age out within 7 more days.
An owner deletes the company from the subscription page by typing its name. Everyone loses access at once and the subscription is cancelled straight away. Until the erasure, Sunday can restore it if it was a mistake. If you'd like confirmation that the erasure is done, write to support@hellosunday.ai.

Certifications

Sunday People doesn't hold SOC 2 or ISO 27001 certification. If your review needs more than this page, write to us and we'll answer your questions or your security questionnaire.

Reporting a security issue

If you think you've found a security problem in Sunday People, email support@hellosunday.ai with Security in the subject. Tell us what you found and how to reproduce it. Please don't access other people's data or disrupt the service while you test. We'll reply and tell you what we're doing about it.

Last reviewed 7 November 2026. When something on this page changes, we update it. More on accounts and sign-in is in the Help Center.