SHA-256 hash chain
Each closed record is linked to the previous one with a cryptographic hash, and so is each evidence file. The Super Admin can verify the whole chain at any time.
Security and GDPR
Reliable records and data protected by design
Hours are the basis of every invoice. That is why integrity, privacy and access control are built into the core of Vahetus, not added later.
Integrity
How we protect every record
Several independent layers make any change to the hours detectable.
Insert-only history
Adjustments, flags, evidence and the audit log cannot be changed or deleted. The application uses a database user without those permissions, and database triggers block it even for the database administrator.
Audit log
Administrative actions (new users and projects, portfolio changes, password resets, approvals and rejections) and day-to-day actions (sign-ins and sign-outs, clock-ins and breaks, requests and report exports) are recorded with who, what and when.
Online clock-in
Starting, pausing and finishing a shift are recorded on the server at that moment, with server time. A shift never closes by itself, and if it runs longer than the person usually works on that weekday or past the end of their scheduled shift, Vahetus reminds them to close it.
Access
Everyone sees only what is theirs to see
- Role permissions checked on the server for every request
- Each Account Manager can only access the freelancers in their portfolio
- No public sign-up: only the Super Admin creates users
- Passwords stored only as hashes, never in plain text
- Signing out revokes that session on the server
- Resetting a password ends all of that person’s sessions immediately
- Sign-in attempt limits to slow down brute-force attacks
- Each company's data is kept separate: nobody can see or change another company's data
GDPR
Data protection with clear rules
Humanos Tech OÜ is an Estonian company subject to the General Data Protection Regulation.
Clearly defined roles
Your company is the controller of the data it enters into Vahetus and Humanos Tech acts as processor, under a data processing agreement signed with the contract.
Everyone’s rights
Each user sees their own data and can request deletion of their account from the application. Data is anonymised in line with legal retention periods.
No tracking cookies
This website does not use tracking, advertising or analytics cookies, and serves its resources from its own domain.
Where the data is
Your data stays in the European Union
Vahetus data (users, projects, hours, adjustments and evidence) is hosted on OVHcloud servers in France. Each company's data is kept separate from every other company. These are the providers involved, each under a data processing agreement:
-
OVH SAS (OVHcloud)
France, EUHosting of the Vahetus application and its database.
-
Hostinger International Ltd.
Cyprus, EUHosting of this website and Humanos Tech email. It does not host application data.
-
Web3Creative (Web3Forms)
IndiaDelivery of this website's contact form. It receives no application data.
If we add or change a provider that processes application data, we inform client companies in advance, as Article 28 of the GDPR requires.
Data processing agreement (DPA)
We sign a data processing agreement under Article 28 of the GDPR with every client company, together with the contract. If your legal team wants to review it first, we will send you the template.
Does your security team have questions?
Write to us and we will answer your security or data protection team’s questions.
Write to us