Security & Data Protection Practices
Review AccoNova security practices for encryption, access control, cloud hosting, backups, vulnerability reporting and customer security responsibilities.
Use role-based permissions to limit employee and payroll access. Review administrator accounts and remove obsolete users. Never share passwords or authentication codes with support.
Jump to Clause (6 Clauses)
1. Access and account controls
Use role-based permissions to limit employee and payroll access. Review administrator accounts and remove obsolete users. Never share passwords or authentication codes with support.
2. Data handling
Protected connections and controlled access help safeguard records. Keep employee-data exports in authorised locations and restrict access to downloaded salary and identity files.
The public site does not claim independent ISO certification, guaranteed encryption specifications or a numerical availability SLA that has not been verified.
3. Customer responsibilities
Keep browsers and devices updated, review workspace permissions and approve attendance exceptions carefully. Check any contractual backup, recovery and availability terms for your subscription.
4. Security review and disclosures
Contact AccoNova for a procurement or security review and the disclosures required for your processing agreement. Backend vendors, database identifiers, regions and deployment topology are not published on marketing pages.
5. Report a security issue
Email hello@acconova.in with the affected page, approximate time and steps to reproduce. Do not include credentials or unnecessary employee data. Avoid further access once a potential vulnerability is identified.
6. Data breach reporting
If we become aware of a personal data breach, we will take prompt steps to contain and assess it, notify affected customers, and notify the Data Protection Board of India and the affected Data Principals in the manner required by the Digital Personal Data Protection Act, 2023.
Report a suspected security issue to hello@acconova.in. Do not include credentials or unnecessary employee data.