Security at Nyoma

Last updated: September 2026

Nyoma handles attendance, payroll, location and customer data for whole companies, so security is built into the product — not added afterwards. Here's how we protect your data.

Tenant isolation

Nyoma is multi-tenant by design. Every record is scoped to a tenant, and every API request resolves the tenant from the authenticated token — never from the URL — so one company can never read or write another company's data. This is enforced at the data layer and independently checked in our release process.

Authentication & access control

• Stateless JWT authentication with short-lived access tokens and rotating refresh sessions, tracked per device so signing out on one device doesn't affect others.
• Role-based access control across six roles (Owner/Admin, HR, Manager, Sales Rep, Employee, Super Admin), plus per-user module access that admins can grant or revoke — enforced at the API, not just hidden in the UI.
• Optional Google and Microsoft SSO; we never see your provider password.
• Administrators can force a password reset; changing a password revokes other active sessions.

Encryption

All traffic is encrypted in transit over HTTPS/TLS. Sensitive integration secrets (such as connected-mailbox tokens) are encrypted at rest. Passwords are stored only as salted hashes.

Accounting, ERP & warehouse integration controls

• Provider credentials are encrypted server-side and are never returned to the browser, written into mapping worksheets or requested by email.
• Every tenant selects the authoritative source per data domain; a connected provider is not assumed to own products, inventory, invoices or any other record automatically.
• Stable provider IDs, idempotency keys and retry-safe jobs prevent name-based remapping and duplicate posting.
• Provider mutations require a tested adapter, declared capability and a current external-state check. A catalogue entry alone cannot connect or synchronize data.
• Connection changes, data-source decisions and business mutations remain tenant-scoped, permission-controlled and auditable.

See the integration overview and printable onboarding checklist.

Auditing

Nyoma records audit history for supported administrative and business operations. Ask the team to demonstrate the audit trail for the specific modules you plan to use.

Application hardening

• Input validation on every endpoint and rate limiting on authentication routes.
• Upload size limits, a tuned Content-Security-Policy and standard security headers (nosniff, frame protection, HSTS, referrer policy).
• Regular dependency auditing to keep third-party libraries free of known high-severity vulnerabilities.

Availability & backups

The application runs on a VPS behind Cloudflare; uploaded files use Cloudflare R2. The team takes database backups. Backup frequency, restore testing, recovery targets and retention terms should be confirmed in a customer agreement before relying on them for your continuity plan.

Multi-factor authentication

We do not currently publish a verified Nyoma-enforced MFA capability. If MFA is required, ask the team to confirm the available sign-in configuration during evaluation.

Data ownership & deletion

Your organisation controls its business data. Ask [email protected] for the available export format and offboarding steps before cancellation. Individual accounts can request deletion; company-managed accounts are handled with their administrator. Legal retention can limit immediate deletion. See our Privacy Policy for details.

Reporting a vulnerability

If you believe you've found a security issue, please email [email protected] with details. We appreciate responsible disclosure and will respond promptly.