One server fails
The database runs across several servers, and a confirmed entry is stored on at least two of them. Another server takes over automatically.
Security
Security is built in
Your employees’ data is in Helsinki, in Hetzner’s data centre. Here is how it is protected and how you can check it.
Access rights
The role sets the view
An employee sees their own data, a supervisor their team, payroll the payroll export and the administrator the whole picture.
- Viewing is recorded too When someone opens an HR case note, another person’s sensitive personal data or the sickness-absence follow-up, an entry is written to the audit log. The administrator browses the log in settings and exports it when needed.
- Correction history is retained The original confirmed entry is retained. A correction records who changed it, when and why.
- Support access is always read-only Support opens a temporary read-only session only for a recorded reason. Support cannot change the data, and the session is recorded in the event log.
When the service is disrupted
Data is corrupted
The continuous transaction log and backups allow the database to be restored to a chosen point within the previous two weeks.
The production environment is lost
Backups are stored in a separate service in Finland. The service can be rebuilt from them, and the recovery process is rehearsed regularly.
Backups are disrupted
Database health, replication and backup progress are monitored continuously. Monitoring also raises an alert if the check itself stops working.
Data lifecycle
Retention periods are visible in the settings
Kelomo shows retention periods after employment ends by data category. An administrator checks whether deletion is permitted and confirms each stage.
- Working-time record retention follows the law Section 32 of the Finnish Working Time Act ties retention to the claim periods in sections 40 and 41. The period depends, among other things, on whether employment continues. The administrator must check the applicable period before deleting data.
- The data is yours The whole organisation’s data can be taken out as a single export. The administrator answers an employee’s data subject request with an export and a PDF summary.
For procurement
Documents
The data processing agreement sets out the responsibilities and the terms of processing. The technical and organisational measures describe the safeguards this page summarises. The service level description gives availability and support response times, and the sub-processor list tells you who else processes the data.
For IT
Customer data is isolated at database level using PostgreSQL Row-Level Security, and the boundary is checked in every query.
An organisation can sign in through its own identity provider, such as Microsoft Entra ID, Google Workspace or another OIDC service. Its own policy then handles multi-factor authentication. For Kelomo password sign-in, passwords are stored as argon2id hashes, attempts are rate-limited by IP address and account, and deactivation immediately ends all of the person’s sessions.
Traffic is encrypted with TLS from browser to server and server to database. Payroll and integration credentials are encrypted with AES-256-GCM. API keys are limited to the user’s permissions and selected scope. Webhooks are signed using HMAC-SHA256 with a timestamp.
The database transaction log is archived continuously, backups are taken daily and a separate copy is stored weekly in another store. Every attachment is checked for malware with ClamAV in our own environment. The mobile app opens with biometrics or the device passcode, and the punch device’s local database is encrypted.
Frequently asked
What does the app ask the phone for, and why?
Location at the time of clocking, if the employer has enabled location-based clocking. The default then records whether the person was within the work site’s area. Exact coordinates require a separate employer setting; location is not tracked between clockings. The camera is used for receipts and QR codes. Notifications provide reminders about shifts and approvals, for example. Permissions are managed in the phone’s settings. Denying a permission prevents features that require it, such as clocking that requires location.
Does Kelomo use AI on my data?
Optional receipt recognition processes the receipt provided to it. A user can also connect an external AI assistant to Kelomo. With explicitly granted permissions, the assistant can access data such as time entries, which its provider processes under its own terms. Processing locations and sub-processors are listed in the procurement documents.
How will you notify us of a security incident?
Without undue delay, in accordance with the data processing agreement: what happened, who is affected and what we have done.
I found a security issue. Where do I report it?
To hei@kelomo.fi with the subject “Security”. The same contact is listed at kelomo.fi/.well-known/security.txt. We reply to every report.
Still have a question? Write to us
Try it free for 30 days · no card