Your data is kept apart from every other company's
Every record in Rivert belongs to one organization, and the database itself enforces it. Before it returns a single row, it checks that the row belongs to the organization of the person asking. This is a rule in the database, not just in the application's code, so a mistake in the application cannot show your employees to another company.
Payroll that can't be changed quietly
- A finalized month is final. Once a payroll run is finalized, Rivert offers no way to edit its figures.
- Corrections are added, never written over. A mistake found later is fixed with an adjustment run that carries only the difference. A declaration already filed is corrected with an amendment that refers to the original. You can always show an inspector what was paid, what was declared, and what changed afterwards.
- Payslips keep their own history. Each payslip stores the figures it was calculated from. Changing an employee's contract later doesn't rewrite last year's payslips.
Every action on record
Everything that affects payroll is recorded in an audit log: who calculated, approved or finalized a run, who generated a declaration, and when. The log can be added to but not edited.
Sign-in that resists attackers
- Two-factor authentication is required for administrators, payroll operators and HR staff, the people who can see other people's salaries. Employees who only see their own payslips can turn it on if they want.
- No codes by SMS. The second factor is an authenticator app, because SIM swaps make SMS codes easy to steal.
- Recovery that isn't a back door. If someone loses their phone, they use a recovery code. Failing that, another administrator can reset their second factor. Our support team can do the same for a sole administrator, but a reset never signs anyone in: the password is still needed, and every administrator in your organization is emailed when it happens.
- Guessing is cut off. An account locks for 15 minutes after 10 wrong passwords in a row, and repeated attempts from the same address are slowed down.
Each person sees only what their role allows
You decide who can do what. An employee's account can reach only their own payslips, leave and reviews. An administrator can give others only powers they hold themselves, so nobody can create an account more powerful than their own.
Where your data lives
- Rivert runs on servers in the European Union.
- All traffic goes through Cloudflare, which filters attacks, and is encrypted all the way to our servers. The servers refuse connections that don't come through Cloudflare.
- Payslips and declarations are stored as files in Cloudflare R2.
- Passwords and keys are kept in a dedicated secrets manager, never in the code.
- The database is backed up to separate storage.
Reporting a problem
If you think you've found a security issue in Rivert, write to [email protected]. We'll look at it straight away and keep you informed.