This page describes controls that are actually built and running today — not a roadmap and not a compliance certification. We will update it as the product changes, and we will not claim a certification we have not earned.
Passwords are hashed with scrypt before they touch the database. Session tokens, refresh tokens, and MFA recovery codes are stored as versioned HMAC lookup values, never as the raw secret a user typed or received.
When a Super Admin enables an authenticator app, the TOTP secret is encrypted at rest with AES-256-GCM under a key derived separately from session/token hashing, so a database copy alone cannot regenerate valid codes.
Every check-in and check-out is verified on the server: required signals (approved device, geofence match, selfie, device unlock) are checked with AND logic before an attendance record is created. A modified client cannot mark itself compliant.
An employee's attendance can only come from a phone your admin has explicitly approved. A new device raises a request instead of silently taking over.
Every persisted record carries its company, and every query is scoped to the caller's company on the server. Cross-company references are refused without disclosing whether the target exists.
Administrative and platform actions are recorded to an audit log that application roles cannot edit or delete, so what happened and who did it stays reconstructable.
Platform (Super Admin) authority is an explicit, revocable grant tracked separately from ordinary sign-in — it is never inferred from an email address or a flag on the user record.
If you believe you have found a security issue in Presentee, please use the Support page to reach us with details. We take reports seriously and will follow up directly.