Security checklist

An integration with KalHR handles employees' personal data, and sometimes their pay. Go through this list before it goes live.

Keys

Each system has its own key, named after the system. One key shared by several systems can't be revoked without stopping all of them, and the audit log can't tell them apart.
Each key has only the access it needs. A system that reads leave doesn't need Payroll: View. Without it, salaries are left out of employee records.
Keys live in a secret store or environment variables, never in code, a repository, a ticket or a chat.
Keys are used only from servers. Never in a browser, a mobile app or anything you hand to users.
Keys for short projects and contractors have an expiry date.
Someone owns each key. Its description says who, so it's clear who to ask before revoking it.

Every request's signature is checked before anything in it is trusted, using the raw body. See Verifying signatures.
Old timestamps are refused: more than 5 minutes from your clock.
Events are handled once, by remembering each event id.
The signing secret is stored like a key: in a secret store, never in code.
The endpoint uses HTTPS with a valid certificate. KalHR won't send to anything else.

You keep only what you need. Fetch the fields your system uses, and delete what it no longer needs.
Pay and identity numbers are protected in your system as carefully as in KalHR: encrypted, and visible only to the people who need them.
Logs don't hold keys, secrets or personal data. Log ids, not whole records.

Revoke it at once in Settings → API keys. Requests with it are refused within a minute.
Create a new key with the same access, and move your system to it.
Check what it did. The audit log records changes made with the key under its name, and the key's page shows when it was last used and from which IP address.
Remove it from wherever it leaked: the repository's history, the ticket, the chat.

Rotate it: the key icon on the endpoint in Settings → Webhooks. The old secret stops working at once.
Update your receiver with the new secret. Deliveries that fail in between are retried.

If you find a security problem in KalHR itself, contact us and say it's a security report. Please don't test against another organisation's data.