Security & Data Protection

Last updated: July 2026

Our agency takes the protection of worker, applicant, client, and financial information seriously. This page summarizes, in plain language, the safeguards built into the system we use to run our business. It is a summary of our practices, not a warranty or contract.

Encryption

• In transit: all connections to the application are protected with TLS (HTTPS), so data moving between your browser and our servers is encrypted.
• At rest: the most sensitive personal data — Social Security numbers, dates of birth, bank account and routing numbers, and uploaded identity documents (such as I-9 support) — is encrypted with authenticated AES-256 (GCM) encryption before it is stored. Encryption keys are held outside the database.

Access controls

• Least privilege & role-based access: every user account is granted only the specific permissions their job requires. Sensitive screens (payroll, personnel records, financials, settings) are gated by granular permissions, not a single "admin" switch.
• Server-enforced: access rules are enforced on the server for every request — not just hidden in the interface — so protected data cannot be reached without the right session and permission.
• Sensitive-field gating: revealing a full Social Security number or bank detail requires an explicit permission and is recorded in the audit log.

Authentication

• Passwords are stored using one-way hashing — never in readable form.
• Multi-factor authentication (authenticator-app / TOTP) is available for staff accounts, with protection against code reuse and lockout after repeated failed attempts.
• Sessions are bound to the signed-in company and expire; state-changing actions require a per-session security (CSRF) token.

Banking connections

When we connect a bank account for reconciliation, we do so through Plaid, a specialized and widely used financial-data provider. We never see or store your online-banking username or password — those are entered directly with Plaid. The access token Plaid returns is encrypted at rest, imported transactions are read-only, and nothing posts to our ledger automatically — every imported item is staged for a person to review.

Secrets & keys

API keys and secrets for payment, banking, and tax services are kept in protected server-side configuration — outside the database and outside our source code — and are not exposed to the browser or to reports.

Monitoring & audit trail

Sensitive activity — viewing protected identifiers, payroll changes, voids, and configuration changes — is recorded in an audit log with the user, time, and source, so activity can be reviewed and reconciled.

Data separation

The platform keeps each company's data logically isolated, so one organization's records are not visible to another.

Data retention & disposal

We keep personal data only as long as we need it for employment, legal, and tax obligations, then archive or securely purge it. Talent-pool records are retained on a defined schedule and anonymized when they age out. See our Privacy Statement and our Data Retention & Disposal Policy for the specific windows and how data is disposed of.

Ongoing diligence

The application undergoes regular internal security reviews and dependency updates, and access is reviewed as roles change. We do not claim any third-party certification on this page; where a specific attestation is required, please contact us.

Reporting a concern

If you believe you have found a security issue, or have a question about how your data is protected, email us at security@midsouthtalent.com and we will respond promptly.

← Privacy Statement