The system being up on payroll day is not a coincidence
On the last day of the month everyone logs in at once, timesheets close and payroll is calculated. The infrastructure was built for that one day: independent services, automatic scaling and a written service level commitment.
Six decisions, all from the same principle
The system was designed not to “never break” but to “recover when it does”. Each heading below is an application of that principle.
One module does not bring down another
Payroll, leave, attendance, ATS and performance run as separate services. Updating one module, or one straining under load, does not stop the others.
Independent containers, REST between services, event-based messaging
In the cloud, with nothing to install
The application and data layers run on AWS; there are no servers, licences or maintenance windows on your side. Capacity grows automatically during busy periods.
AWS Europe (Frankfurt / eu-central-1), multi-availability-zone deployment
Data encrypted in transit and at rest
Traffic from the browser to the server and records sitting on disk are both encrypted. Encryption keys are held in a service separate from the application.
TLS 1.3 in transit, AES-256 at rest, key management via AWS KMS
Customer data never mixes
Each company’s data sits in a logically separated schema. A query reaching another company’s records by accident is prevented architecturally.
Tenant-based isolation, role-based permissions, full audit log
Taking backups is not enough — you have to restore
Backups are taken regularly and kept for thirty days. What matters more is rehearsing the restore: the disaster recovery scenario is tested on a schedule.
Thirty-day retention, monthly recovery drill, point-in-time restore
Not a closed box
It talks to your existing ERP, accounting and payroll systems. Where there is no ready-made integration, you connect over API and webhooks.
REST API, webhook triggers, Swagger-based documentation
The commitments written into the contract
Every line in this table appears in the service agreement in the same form. What happens when one is missed is defined there too.
| Metric | Commitment |
|---|---|
| Monthly uptimeExcluding planned maintenance | 99.9% |
| Planned downtime ceilingOutside business hours | 4 hours / month |
| Support response — P1 (system down)Always-on channel | 30 minutes |
| Support response — P2 (function broken)Within business hours | 4 hours |
| Database backup frequency30-day retention | Hourly |
| RTO — time to bring the service backIn a disaster scenario | 4 hours |
| RPO — accepted data lossRestore to the last backup point | 1 hour |
Planned maintenance is announced at least five working days in advance and carried out outside business hours. No planned maintenance takes place on payroll closing days.
Not one door, but four
Getting past one layer does not invalidate the others. Four sets of controls, ordered from the outside in.
- Network edge
Before a request reaches the application
A web application firewall cuts known attack patterns, and DDoS protection stops volumetric attacks before they reach the application.
- Identity
Before you are confirmed as who you say you are
Role-based permissions, session control, and multi-step verification for administrator accounts. Access can be narrowed at location and module level.
- Application
Services do not trust each other
Every call between services is separately verified. Every action — who, when, which record — is written to an auditable log.
- Data
Everything written to disk
Encrypted storage, tenant-based isolation, and a defined deletion procedure for data whose retention period has expired. Backups carry the same encryption.
We document what we claim
Audit reports and certificate copies are all shared during the purchasing process.
ISO 27001
Information security management system certification. Evidence that processes are documented, responsibilities assigned and auditing regular.
SOC 2 Type I
A report in which the security, availability and confidentiality principles are examined by an independent auditor.
KVKK compliance
Obligations as a data processor under Turkish data protection law: a category-based processing inventory, a retention and destruction policy, and a channel for requests. Details
TLS 1.3
All client traffic is encrypted with the current protocol. Certificate management runs on automatic renewal.
Let’s answer your IT team’s questions directly
We run technical briefings on architecture, integration and data security. An engineer from our side joins the call too.