Humareso treats your data as if it’s our own, even if you’re not a client
That holds for the records of the people you employ, including leave and health details most of them would never discuss at work. Here is how we look after it, and how to reach us if you need more than an overview.
Current as of October 14, 2026
Built on infrastructure you already trust
Our platforms run on established cloud providers, each of which maintains its own independent security attestation. We operate no data centres of our own.
Encrypted, coming and going
Client data is encrypted in transit and at rest. Backup copies are held with more than one provider, so a problem in one place does not put your records out of reach.
Access limited to what the job needs
Access follows the role, and health and leave detail is kept from roles that have no reason to see it. Client data is separated by organization. You can bring your own single sign-on, so joiners and leavers in your directory reach us without a support ticket.
Working towards SOC 2 Type II
We have committed to a SOC 2 Type II examination on the Security and Confidentiality criteria. The observation window opens on December 1, 2026 and we expect the report in mid-2027. We are not SOC 2 certified yet, and we will not say otherwise until that report exists.
Need more than this page?
Most people reading this are working through a security review, and we would rather answer you properly than leave you with a summary. We complete security questionnaires in your own format, share our policies under an NDA, and will walk your team through the architecture and the controls live.
Our sub-processor list and Data Processing Agreement are published in full and kept current.
Write to DPO@humareso.com and a person will answer you. If you think you have found a security problem in one of our products, use the same address and we will take it seriously.
Know before our sub-processors change
We publish every third party that touches client data on our sub-processor list. Our Data Processing Agreement commits us to telling clients at least 30 days before we add, replace or remove one, and gives you 14 days to object on data protection grounds. Subscribe here and that notice reaches you directly.