Built to be inspected.

Sponsor compliance data deserves concrete answers, not a reassuring paragraph. Here is what actually happens to your records.

Company-scoped data, isolated twice over

Every query is scoped by Company at the application layer, and PostgreSQL Row-Level Security policies enforce the same boundary again at the database — a second, independent layer, not just application code you have to trust.

Sensitive fields encrypted and masked

National Insurance numbers, passport numbers and bank details are encrypted at the application layer (not just disk encryption) and masked on screen until deliberately revealed.

Append-only audit log

Changes to Right to Work status, salary and permission grants are written to an audit table in the same transaction as the change, and the log itself cannot be edited or deleted through the product.

Upload controls on every document

File uploads are restricted by an allow-list of file types and extensions, a size limit, and a malware-scan hook, before anything is stored.

Private storage, short-lived links

Documents live in a private, S3-compatible bucket with server-side encryption at rest. Downloads use signed URLs that expire quickly rather than permanent public links.

Stripe handles payment

Card numbers are entered directly into Stripe Checkout and never reach our servers — we only ever see that a payment succeeded.

Honest about scope

MadyHR.ai is HR and sponsor-compliance software, not a law firm. It does not submit reports to the Sponsor Management System on your behalf, and it does not give legal or immigration advice — for that, take advice from a qualified immigration adviser or employment solicitor.

Questions about security or a specific control your compliance officer needs to see?