Security

How the Gokaizen Suite protects the information in it, and what is expected of you. This page describes the measures in place; the privacy policy says what data is processed and why, and the terms of use what you agree to.

Signing in

• Sign-in is handled by Auth, never by the suite itself. The suite's sign-in screens pass your password, code or passkey straight to Auth and keep nothing.
• Repeated wrong passwords or codes lock the account for a time. The sign-in and password-reset screens never reveal whether a username exists.
• Two-step sign-in (an authenticator app or a security key) and passkeys are available to everyone. Turn them on under your account; people who handle payroll, HR or approvals should.
• Passwords must meet a minimum length and complexity.

Your session

• A session is a signed, encrypted cookie that scripts on a page cannot read, sent only over HTTPS, and it expires after a working day.
• The suite re-checks with Auth regularly that your account is still active, and checks on every request that the session has not been ended. Sign out other sessions under your account ends them at once, everywhere.
• Deactivating a person's access ends their sessions and every assistant they connected.

What you can see and do

• Every screen and every action requires a specific permission, granted through roles by an administrator. The check is made by the suite's own logic for each action, not by hiding buttons, so a link someone was not meant to have still does nothing.
• Administrators can grant or deny individual permissions to a person on top of their roles, and the suite prevents an administrator from locking everyone, including themselves, out.
• Self-service screens (My Work) can only ever reach your own record and your own payslips.

A record of everything

• Every change, who made it, when, and from which address is written to an audit log that administrators can review.
• Requests made through a connected AI assistant are logged as well, under the person's own name.

Protection against abuse

• All traffic is HTTPS only, and browsers are told to never try plain HTTP again once they have seen the site.
• Requests are rate-limited by network address, with the strictest limits on the sign-in screens, so a script cannot guess, probe or overload the suite at speed.
• Oversized requests are refused, and the pages tell browsers not to sniff content types, not to allow the suite to be embedded in other sites, and to grant only the device features the suite uses (your location and camera, for the time clock, and only when you clock in or out).
• The connection for AI assistants has its own, stricter set of limits, described on that page.

Where the data lives

• Each part of the suite keeps its data in its own database, with its own credentials that cannot reach the others. The databases are not reachable from the internet.
• Infrastructure is reachable only by named administrators over keys, never passwords.
• Backups are taken nightly and kept encrypted, with an off-site copy.
• Server logs are kept for a limited time and then deleted, as the privacy policy states.

What we ask of you

• Keep your account to yourself. Never sign in for someone else, or let someone sign in as you.
• Turn on two-step sign-in or a passkey.
• Use only devices you trust, and sign out on shared ones.
• Report anything odd, such as a sign-in you did not make or a record you did not change, to internal@gokaizen.ai right away.

Reporting a security problem

If you believe you have found a weakness in the suite, write to internal@gokaizen.ai with what you saw and how to reproduce it. Do not test it against other people's data. We will acknowledge the report and tell you what we did.