Skip to main content
EkaSetu

Security

Your consultants’ data, protected by default.

EkaSetu holds Social Security numbers, visas, I-9s and pay rates. Here is exactly how they’re protected today, and what comes next.

Sign-in

  • Two-step sign-in (an authenticator app code) for every account: owners, staff, consultants and vendors.
  • Passwords of at least 10 characters, stored only as salted hashes.
  • Repeated wrong passwords are slowed down; each sign-in and failed attempt is recorded.
  • Signed out automatically after 15 minutes without activity.

Each company's data stays its own

  • Every record belongs to one company, and every page and action checks it.
  • Consultants see only their own timesheets and documents. Vendors see only their own consultants, hours and invoices, never your bill rates or clients.
  • Client approvers approve from a one-time link: stored only as a hash, limited to their consultants and that week, and expiring after 21 days.
  • Automated tests check, on every change, that one company can't see another's data and that each role sees only its own.

Encryption

  • Social Security, passport, A-numbers, I-94 and document numbers, home addresses and form answers are encrypted (AES-256-GCM) before they're stored. Screens show only the last four characters.
  • Uploaded documents are encrypted on disk, fingerprinted (SHA-256) when stored, and refused if the file has been altered.
  • Emails with one-time links are encrypted while they wait to be sent and cleared once sent.

Documents

  • Only real PDF, PNG and JPEG files are accepted, checked by their contents, up to 10 MB.
  • Images open in a locked-down sandbox; PDFs open in the browser's own viewer. Nothing in a file runs as part of EkaSetu.

E-signatures

  • Signers agree to sign electronically first, then sign with their typed name.
  • Every signed PDF carries an envelope ID and a certificate page (who, when, from where, and the fingerprint of the original), and a digital seal that breaks if the file changes.
  • Anyone holding a signed copy can check it on the Verify page.

Audit log

  • Sign-ins, document views, approvals, edits, exports and settings changes are recorded with who did them and when.
  • Approvals keep the name of the person who approved, even if the placement's approver changes later.

Not yet, but planned

We’d rather tell you than let you assume:

  • Nightly encrypted backups, with a restore tested on a schedule.
  • Production hosting with uptime and error monitoring.
  • An independent security assessment, then SOC 2 as customers ask for it.

Found a security issue?

Tell us privately and we’ll respond quickly. Please don’t test against other companies’ data.

Contact us

Or email [email protected].