Secure Authentication
Passwords are protected using one-way hashing and secure verification. Password policy, repeated-login protection, secure reset tokens and session renewal add further safeguards around account access.
Security & Trust
Protecting access, workforce data and accountability at multiple layers.
Kalzeo is designed with practical security controls across authentication, authorization, tenant data handling, private files, attendance verification, auditability and production recovery.
Server-side access enforcement
Private tenant file storage
Daily production backups
Layered protection
Security is more than a login screen.
IdentityAuthentication & password protection
AuthorizationRoles, permissions & access scope
Tenant & DataPrivate storage & controlled access
ApplicationRequest validation & server controls
AccountabilityAudit trails & security evidence
Our customer-data principle
Your business data is used to provide your service — not sold as a product.
Kalzeo's business model is based on providing software and services to customers. We do not sell customer business or employee data to advertisers.
Security by design
Controls across identity, access, data and operations.
Kalzeo combines multiple safeguards so that protection does not depend on a single control. The controls below reflect capabilities implemented in the current platform.
Role-Based Access Control
Roles and permissions help control which functions an authorized user can access, supporting separation of responsibilities across workforce and administrative operations.
Site & Operational Scope
Access can be scoped by supported site and organizational context so users work within the operational areas assigned to them rather than receiving unnecessary broad access.
Server-Side Authorization
For supported protected workflows, access decisions are enforced within server-side application logic. Interface visibility alone is not treated as the security boundary.
Tenant-Aware Protection
Kalzeo's cloud architecture maintains tenant-specific runtime context and storage namespaces to support controlled separation of customer operational data and files.
Private File Protection
Supported employee files use tenant-specific private storage outside the public web document root, with upload validation, randomized stored filenames and application-controlled delivery.
Sensitive workforce data
Additional protection for supported biometric attendance data.
Face-based attendance introduces sensitive data-handling responsibilities. Kalzeo applies dedicated protection to supported face-enrolment templates and verification workflows rather than treating biometric data like an ordinary field.
Encrypted biometric templatesSupported face templates are encrypted server-side using AES-256-GCM authenticated encryption.
Integrity validationAuthenticated encryption and template integrity checks help detect altered or invalid protected template data.
Controlled verificationDecryption and verification occur within protected server-side workflows.
Audit-conscious handlingBiometric template material is not intended to be exposed as ordinary audit content.
Protected verification flow
01Employee enrolmentAuthorized face profile setup
02Authenticated encryptionProtected template storage
03Server-side verificationControlled template use
04Attendance authorizationVerified workflow continues
Secure attendance workflows
Attendance decisions use more than a browser-submitted value.
Kalzeo's supported Smart Attendance and Shared Kiosk workflows combine identity, device, site and server-side validation to strengthen attendance capture.
Face Verification
Employee-specific face verification is used within supported Smart Attendance workflows.
Liveness Checks
Configured liveness actions add an active verification stage before supported face attendance proceeds.
Geofence Validation
Location, site assignment and configured geofence context are validated within the attendance workflow.
Kiosk & Device Context
Shared Kiosk workflows use controlled machine/device context and short-lived attendance authorization.
Short-lived authorization. Supported verified attendance flows use time-limited, controlled authorization so a successful identity check cannot simply be reused as an unrestricted attendance action.
Application protection
Security controls continue behind the interface.
Kalzeo applies application-layer safeguards around supported protected actions, database operations and sensitive data delivery.
CSRF ProtectionSecurity tokens protect supported state-changing application requests.
Parameterized Data AccessPrepared and parameterized database operations are used extensively across the platform.
Validated File HandlingSupported private uploads validate extension, MIME type and file size before storage.
Path ProtectionPrivate file handling includes safeguards against unsafe storage paths and traversal.
Audit & accountability
Important activity can leave an operational trail.
Supported Kalzeo workflows record audit information such as the acting user, action, module, reference context and other evidence where applicable. Dedicated security-event records are also used in supported attendance workflows.
- Administrative and operational audit trails
- Old/new value context where supported
- Site and request context where applicable
- Configurable audit-retention options by supported entitlement/configuration
Backup & recovery
Daily production backups add a recovery layer.
Kalzeo's current production hosting environment uses automated daily backups covering production files and databases, providing a recovery layer for operational data.
- Automated daily hosting-level backups
- Production files included
- Production databases included
- Restoration capability through the hosting environment
Backup and recovery capabilities may evolve with hosting architecture, customer requirements and service arrangements.
Privacy & responsible data use
Security and privacy work together.
Kalzeo separates public website data handling from customer tenant data and uses privacy-conscious controls for website analytics. Customer business and employee data is not sold to advertisers.
Purpose-led handlingData is handled to operate and provide relevant Kalzeo services and workflows.
Consent-aware analyticsOptional website analytics are controlled through the website's privacy preferences.
Clear privacy informationOur Privacy Policy explains website data handling and the distinction between public website and customer tenant information.
Continuous improvement
Security is an ongoing engineering responsibility.
We continue to review and strengthen application, hosting and operational controls as Kalzeo grows, the platform evolves and customer requirements develop.
Talk to Kalzeo
Need to discuss security, data protection or deployment requirements?
Speak with our team about how Kalzeo can support your workforce and operational requirements.