> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hr-easy.nlead.ch/llms.txt
> Use this file to discover all available pages before exploring further.

# Data protection (nDSG)

> Swiss data-protection obligations, residency, retention, and how the platform implements them.

The revised Federal Act on Data Protection (nDSG) governs how the platform handles
personal data. HR data is squarely within its most sensitive categories — health data,
in the case of sick leave and medical certificates.

## Controller and processor

Swiss HR Easy is deployed **single-tenant**. Each customer operates their own
environment and is the **data controller** for it. The platform vendor's role is
defined by the agreement between the parties; the product's job is to make compliant
operation possible.

## Data residency

| Property                     | Implementation                                                                |
| ---------------------------- | ----------------------------------------------------------------------------- |
| Region                       | Azure Switzerland North for Swiss customers.                                  |
| Isolation                    | Dedicated database, storage account and Key Vault per customer.               |
| Encryption in transit        | TLS throughout; HSTS on production domains.                                   |
| Encryption at rest           | Platform-level for the database and blob storage.                             |
| Application-layer encryption | Credentials, tokens and other secrets encrypted with a key held in Key Vault. |

<Warning>
  Credentials and tokens are never stored as plaintext. A field holding a credential, session token
  or API key must use the application-layer encryption utilities — a raw `String?` column for such a
  value is a defect. See [Security conventions](/development/security).
</Warning>

## AI and third-country processing

Where [AI features](/guides/ai/overview) are enabled, content is sent to the model and
embedding providers for processing. This is disclosed in the transparency notice, is
optional per installation, and is auditable — every AI call is recorded as
`AI_OPERATION`.

Applicants can decline AI processing entirely, and withdrawing consent deletes both the
generated output and the derived search index entry. See
[AI transparency](/guides/ai/transparency).

## Data subject rights

| Right            | How it is served                                                |
| ---------------- | --------------------------------------------------------------- |
| Information      | The privacy notice and the AI transparency notice.              |
| Access           | A structured DSAR export of everything held across modules.     |
| Rectification    | Correction through the record, with the change audited.         |
| Erasure          | DSAR erasure, subject to statutory retention.                   |
| Objection        | AI opt-out; withdrawal of consent where processing rests on it. |
| Data portability | Machine-readable export.                                        |

Requests arrive through a public endpoint — the requester is often a former employee or
a rejected applicant with no account — protected by CAPTCHA that **fails closed** on a
partial configuration, identity verification by confirmation link, and a cooling period
between requests. See [Audit and DSAR](/guides/admin/audit-and-dsar).

## Retention

Erasure is not absolute. Swiss law requires records to be kept:

| Category                                        | Retention                                                                      |
| ----------------------------------------------- | ------------------------------------------------------------------------------ |
| Payroll records, payslips, accounting documents | Statutory accounting and tax retention.                                        |
| Filed declarations                              | Already transmitted; retained as the filed record.                             |
| Employment contracts                            | Contractual and evidentiary retention.                                         |
| Audit entries                                   | The integrity record of the system itself.                                     |
| Applications from unsuccessful candidates       | Configurable per installation; deleted or moved to a talent pool with consent. |

A DSAR response states what was erased **and what was retained, with the legal basis**.
Quietly retaining data is not a compliant response.

## Processing records and logging

* Every state-changing operation is audited: who, what, when, before and after.
* Sensitive values are masked before storage; client IPs are truncated.
* Structured logs go to Application Insights with correlation IDs, without personal
  data in log messages.

<Note>
  `console.*` is banned in application code precisely because ad-hoc logging is how personal data
  ends up in a log aggregator nobody has a retention policy for. All output goes through the
  structured loggers.
</Note>

## Security posture

* Role-based access control with ownership checks on **every** HTTP verb.
* Session-based authentication with secure cookies; SSO through Entra ID.
* Magic links signed, expiring, and compared in constant time.
* Redirect targets validated as `https://` before use.
* No tokens in `Location:` headers or query strings.
* Secrets in Key Vault, rotated with documented procedures.

## Breach notification

The nDSG requires notification to the EDÖB where a breach is likely to result in a high
risk to the data subjects. The technical side of detection and response is in the
[incident runbook](/operations/runbooks).

<Warning>
  The incident runbook does **not** yet cover the breach assessment or the EDÖB notification
  decision. Those remain the controller's process, and an incident with a suspected data exposure
  must be escalated to the data-protection contact alongside the technical response.
</Warning>

<Warning>
  This page describes what the platform provides. It is not legal advice, and it does not discharge
  the controller's obligations — a privacy notice, a processing register and a data-protection
  impact assessment remain the operating organization's responsibility.
</Warning>