1 Overview & Privacy Principles
Cypherr Inc. ("Cypherr", "we", "our", or "us") operates the Cypherr Enterprise Workforce Management, Automated Tax Payroll, and Agile Kanban Sprint OS. We are committed to upholding the highest enterprise security and data privacy standards.
This Privacy Policy describes the information we collect when your organization provisions Cypherr, how that information is utilized, the rigorous cryptographic safeguards implemented, and the rights you retain over your information under international data protection regulations.
2 Categories of Information We Collect
To deliver seamless workforce operations, payroll execution, and sprint tracking, we process the following categories of data on behalf of our enterprise customers:
- Workforce Identity & Profile Data: Full legal names, corporate email addresses, employment identification numbers, job titles, reporting department structures, and emergency contact details.
- Payroll, Banking & Tax Information: Direct deposit routing and account numbers, statutory tax identification numbers (SSN/EIN/PAN), compensation tiers, overtime logs, and withholding allowances.
- Attendance & Verification Telemetry: Clock-in/out timestamps, GPS coordinates during geofence verification, device hardware signatures, Wi-Fi BSSID identifiers, and cryptographic face/fingerprint validation tokens.
- Sprint & Agile Engineering Metadata: Ticket descriptions, task assignments, burndown velocity, developer time adjustments, and connected Git commit identifiers (SHA hashes).
- System & Audit Logs: User session IP addresses, browser agent headers, access audit trails, and administrative role modifications.
3 Purposes & Legal Basis of Processing
We process Customer Data exclusively under the instruction of the Customer (acting as the Data Controller) and for the following legitimate business purposes:
- Executing precise statutory tax calculations, generating payslips, and submitting automated direct deposit batches.
- Validating on-site physical presence through geofenced perimeter analysis and preventing fraudulent remote clock-in.
- Synchronizing developer sprint velocity and workload heatmaps across engineering squads.
- Enforcing enterprise compliance requirements and generating immutable SOC2 and ISO 27001 audit logs.
4 Geofencing & Biometric Telemetry Handling
Cypherr is engineered with privacy-by-design principles for sensitive physical location and biometric validation:
Biometric Anti-Spoofing Architecture: When biometric verification is enabled on mobile or terminal devices, Cypherr does NOT transmit or store raw photographic facial captures or fingerprint minutiae files on our servers. Biometric checks are executed on-device via secure enclave APIs (Apple FaceID/TouchID or Android BiometricPrompt) and return a signed cryptographic validation token.
5 Cryptographic Security & Architecture
Cypherr utilizes defense-in-depth security measures to protect Customer Data against unauthorized disclosure, interception, or destruction:
- Encryption in Transit: All web, mobile, and API traffic is encrypted using modern TLS 1.3 with forward secrecy ciphers. Non-TLS endpoints are strictly prohibited.
- Encryption at Rest: Database tables, document object stores, and database backup snapshots are encrypted using AES-256 with keys managed by AWS KMS and rotated annually.
- Multi-Tenant Schema Isolation: Customer data is logically segregated using tenant identifiers and row-level security (RLS) constraints to prevent cross-tenant data leakage.
- Vulnerability Management: Continuous dynamic and static code analysis (SAST/DAST) and bi-annual independent third-party penetration testing.
6 Subprocessors & Cloud Infrastructure
We maintain strict vendor evaluation frameworks. Cypherr utilizes the following vetted infrastructure subprocessors:
- Amazon Web Services (AWS): Cloud compute, RDS managed PostgreSQL instances, and S3 storage hosted in US-East (N. Virginia) and EU-West regions.
- AWS Simple Email Service (SES): Automated transactional notifications, welcome invites, and administrative alerts.
- Statutory Banking Gateways: FedACH and NACHA-certified automated clearing house networks for direct deposit routing.
7 Non-Sale & Data Disclosure Restrictions
We do not sell, rent, lease, or monetize Customer Data under any circumstance. We disclose personal data only under the following limited conditions:
- To authorized personnel within Customer’s organization based on Customer’s designated RBAC privilege configurations.
- To our vetted subprocessors solely to the extent necessary to deliver the agreed Services.
- When strictly compelled by law, court order, or binding subpoena issued by a court of competent jurisdiction, after providing prior notice to Customer where legally permissible.
8 Cross-Border Transfers & Safe Harbors
For customers operating within the European Economic Area (EEA), the United Kingdom, or Switzerland, Cypherr ensures appropriate safeguards for cross-border personal data transfers using Standard Contractual Clauses (SCCs) approved by the European Commission, combined with supplementary technical encryption measures.
9 GDPR, CCPA & DPDP Data Subject Rights
Depending on your jurisdiction, employees and data subjects maintain specific rights regarding their personal data processed by Cypherr:
- Right to Access: Request a complete export of personal profile information, attendance logs, and past compensation summaries.
- Right to Rectification: Request correction of inaccurate personal or banking records.
- Right to Erasure ("Right to be Forgotten"): Request cryptographic deletion of personal data, subject to statutory tax and labor record retention laws.
- Right to Restriction & Portability: Obtain personal data in a structured, commonly used, and machine-readable format (JSON/CSV).
Since Cypherr serves as a Data Processor on behalf of your employer (the Data Controller), employees should submit data subject requests directly to their organization’s HR department. We will assist the Customer in fulfilling legitimate requests.
10 Data Retention & Cryptographic Sanitization
We retain Customer Data for the duration of the active subscription agreement. Upon customer termination or formal deletion request:
- Customer has thirty (30) days to download complete data archives.
- All production tenant data is systematically deleted from active databases within 60 days.
- Encrypted backups expire and are purged pursuant to our 90-day rolling disaster recovery retention cycle.
12 Data Protection Officer (DPO) & Inquiries
Cypherr has appointed a Data Protection Officer responsible for overseeing compliance with this Privacy Policy and global privacy regulations.
Data Protection & Privacy Officer
For any questions regarding data processing, privacy audits, or DPA agreements:
Attn: Data Protection Officer (DPO)
Email: cypherr@aventusinformatics.com