Your people's data. What we do with it, plainly.

How to read this page

Some of what follows is in place today. The rest describes how our production platform runs, and it is finished before any client's data goes in. Each item says which. When an item changes, we update this page and record it under Updates.

In place

True today, with evidence behind it

Before client data

How production runs. It is finished before any client's data goes in

At a glance

• Held in-country

  UAE data stays in the UAE. Saudi data stays in the Kingdom. Both on Oracle Cloud.

  Before client data

• Encrypted

  In transit and at rest, with bank and identity numbers encrypted field by field.

  Before client data

• Separated by client

  Each client's data is walled off in the database itself, below the application.

  In place

• Access you can see

  Access follows permissions, and our staff's access to your data is recorded where you can read it.

  Before client data

• A record that shows tampering

  Each audit entry is chained to the one before it, so a change to history is detected.

  Before client data

• Your money

  In payroll, your money never passes through us.

  In place

Certification

We run an information security management system built to ISO/IEC 27001:2022. It covers Global Kinect Ltd and Global Kinect FZ-LLC. Its policies, risk register and supplier reviews are in place and monitored continuously.

We are working towards certification. We are not certified yet. An independent internal audit and a certification audit by an accredited body come first. When a certificate is issued, it will be shown here.

Where your data is held

• UAE

  Production runs on Oracle Cloud in the UAE. Backups stay in the UAE.

  Before client data

• Saudi Arabia

  Data about people employed by a Saudi entity is held in the Kingdom, on Oracle Cloud.

  Before client data

• What decides it

  Where a person's data lives follows the legal entity that employs them. It does not follow their nationality, or where your company is based.

  Before client data

• Recovery

  A copy in a second region in the same country is added as soon as Oracle opens that region to us.

  Before client data

• Outside these regions

  A small number of services handle specific items outside these regions, such as an email address to send a notice. Each is listed under Sub-processors, with what it receives.

  Before client data

• Testing and demonstrations

  These run on generated data. Real pay data never goes there.

  In place

How data is protected

• In transit

  Connections are encrypted with TLS, and the database connection checks its certificate.

  Before client data

• At rest

  Storage and backups are encrypted, with keys held in Oracle's key vault and rotated.

  Before client data

• Bank and identity numbers

  Bank account numbers, IBANs and national ID, iqama, Emirates ID and passport numbers are encrypted field by field.

  Before client data

• Shown masked

  These numbers are masked on screen. Someone with permission reveals one number at a time, and each reveal records who, whose, when and why.

  Before client data

• Salaries

  Protected by the database's separation of clients, by pay permissions and by the audit log. They are not field-encrypted, because payroll has to add them up.

  Before client data

• Audit log

  Each entry carries a hash of the one before. The latest hash is stored daily under a retention lock, and a check alerts us to any break.

  Before client data

• Your audit screen

  You can read and export your log, including a record of any access by our staff.

  Before client data

• Malware

  Uploaded files are scanned inside the platform.

  Before client data

• Logs and error reports

  Personal data is removed from logs and error reports before they are written or sent.

  Before client data

Who can reach your data

• Separation between clients

  Row-level security in the database keeps each client's data apart, below the application.

  In place

• Permissions

  Access follows permissions you assign, within a scope such as one country or one team. Job titles decide nothing.

  Before client data

• Sign-in

  Passwords with a second factor, or single sign-on through your own identity provider.

  Before client data

• Sessions

  Web sessions end after 30 minutes idle and 10 hours in all. Mobile sessions end after 15 minutes idle.

  Before client data

• Sensitive actions

  Releasing a payment file or signing off a payroll asks you to sign in again.

  Before client data

• Leavers

  Deactivating a login ends its sessions within 15 minutes.

  Before client data

• Our staff

  We reach your data only through a named, time-limited assignment or a support grant approved by a second person. Each entry is logged and shown on your audit screen.

  Before client data

How we build and change the software

• Changes

  Every change reaches the main branch through a pull request.

  In place

• Automated checks

  Secret scanning, static analysis and dependency audits run on every change, and must pass before it merges.

  In place

• Vulnerabilities

  Dependency alerts are on for every repository. Critical and high findings are fixed within 30 days.

  In place

• Test data

  Production data is never used in development or testing.

  In place

• Penetration testing

  An independent test every year, with findings tracked to closure. A summary is available under confidentiality.

  Before client data

Availability and recovery

• Availability

  Service levels are set in your contract.

  Before client data

• Resilience

  Two API instances and a multi-node database, across separate fault domains.

  Before client data

• Backups

  Daily, with point-in-time recovery, and an alarm if a backup fails.

  Before client data

• Recovery

  Recovery targets are set in your contract. We measure them in a restore test at least once a year.

  Before client data

• Planned maintenance

  Carried out outside working hours, with notice.

  Before client data

Incidents and reporting a security issue

• Incident response

  A written plan with named roles and a deputy lead.

  In place

• Exercises

  The plan is tested every year.

  Before client data

• If your data is affected

  We tell you without undue delay, as your contract sets out.

  Before client data

Found a security issue? Write to [email protected]. Tell us what you found and how to reproduce it. Please do not access anyone else's data, and give us reasonable time to fix it before you tell others. We do not take legal action against good-faith research that follows these rules.

Data protection and your contract

• Our role

  You are the controller. We process your people's data on your instructions, as your processor.

  Before client data

• Data processing terms

  Part of our standard contract, not an extra to ask for.

  Before client data

• Laws we work to

  Our processing is aligned with Saudi Arabia's Personal Data Protection Law. It also follows the UAE's Federal Decree-Law No. 45 of 2021.

  Before client data

• People's rights

  One person's data can be exported, or erased by anonymising the record, and both are logged.

  Before client data

• Auditing us

  You can ask for the information that shows we meet our terms. Where that is not enough, or a regulator requires it, you can audit us, as your contract sets out.

  Before client data

• Sub-processor changes

  We give written notice before adding or replacing one, and you can object.

  Before client data

• When you leave

  You can export your data. We then delete it, including from sub-processors, within the period your contract sets. Backups are overwritten in their normal cycle.

  Before client data

What we process. Identity and contact details; employment details; pay, allowances, deductions and bank details; national identity, passport, visa and residence details; leave and attendance; dependants; and documents you upload.

Sub-processors

These are the services that handle your people's data in production, what each receives and where.

Our error monitoring service, Sentry, receives system-level information only: no personal data and no user identifier.

People and suppliers

• Policies

  Our information security policies are approved by the directors and reviewed every year.

  In place

• Risk

  We keep a risk register. Every risk has an owner and a treatment decision.

  In place

• Suppliers

  Every supplier is reviewed for security before use and at least once a year.

  In place

• Confidentiality

  Everyone with access signs a confidentiality agreement before they get it.

  In place

• Training

  Everyone with access completes security awareness training, then again every year.

  Before client data

• Joining

  New people with access to client data are screened in proportion to that access.

  Before client data

• Access reviews

  Access is reviewed every quarter.

  Before client data

Our policies

We keep these approved policies, and share them under confidentiality.

• Information Security Policy, and the ISMS Policy behind it
• Access Control Policy
• Asset Management Policy
• Business Continuity and Disaster Recovery Plan
• Code of Conduct
• Cryptography Policy
• Data Management Policy
• Human Resource Security Policy
• Incident Response Plan
• Operations Security Policy
• Physical Security Policy
• Risk Management Policy
• Secure Development Policy
• Third-Party Management Policy

Documents for your review

Ask your Global Kinect contact, or book a demo. We share these under a confidentiality agreement.