Security at LeaveStream
We take security seriously. Here’s how we protect team data across leave, attendance, holidays, and approvals.
How We Protect Your Data
Encryption
We protect data in transit using HTTPS. Sensitive secrets stay server-side and are never exposed to the browser.
Infrastructure
We run on modern managed infrastructure and keep dependencies updated to reduce risk.
Access Control
Role-based access control (employee/manager/admin) helps ensure people only see what they’re allowed to.
Compliance
We minimize data collection and keep audit-friendly records like leave approvals, status changes, and timestamps.
Authentication
Secure login with server-signed sessions and access controls across organizations.
Monitoring
We monitor for errors and unexpected behavior so issues can be fixed quickly.
Our commitments
Least privilege
Roles and permissions are enforced in the app
Secure-by-default
We avoid exposing secrets to the client
Practical transparency
We’ll communicate incidents clearly
Continuous improvement
We prioritize fixes and updates
Our Security Practices
Secure sessions
Sessions are signed server-side, and we keep authentication logic on the server so tokens aren’t exposed in local storage.
Role-based access
Admins, managers, and employees have different capabilities (e.g., approving leave, inviting teammates, managing org settings).
Approvals you can trust
Approval actions are recorded and verified on the server. Email approve/reject links use signed, short‑lived tokens.
Data retention
We retain operational data needed for your organization and provide exports for reporting. Retention controls may vary by plan.
Have Security Questions?
Contact our security team for questions, concerns, or to report vulnerabilities.
leavestream1@gmail.com