Security
This page describes how Absenca protects your data today. It states only what is in place, and we update it when that changes. Our Data Processing Agreement commits to the same measures.
Hosting
Absenca is hosted on Cloudflare's global network; specific regions are not guaranteed. Development, testing and production run in separate environments with separate databases, and development uses fictional data.
Encryption
All traffic is encrypted in transit with TLS, and browsers are told to use HTTPS only (HSTS). Data is encrypted at rest by our hosting provider. On top of that, Absenca encrypts the tokens it holds for connected tools (Slack, Microsoft Teams, Google and Microsoft calendars) before storing them.
Backups
The database can be restored to a point in time within the last 30 days. File attachments are not backed up separately, so deleting one is final.
Roles and access in Absenca
Access follows four roles: admin, location-admin, manager and employee. A location-admin sees only the offices they are assigned to, and a manager only the departments they manage. In the app, colleagues see that someone is away, but never the reason or notes. Shared team calendar events created from 14 October 2026 carry no reason, though earlier events may still contain it until they are removed. A leave type marked private shows as "Away" in the app's calendar and team views. Channel digests, calendar feeds, shared team calendars, scheduled reports and out-of-office replies still show the leave type for now. Attachments such as sick notes can be opened only by the person and the people who review the request, through in-app links that expire after 15 minutes. Data exports an admin requests contain links to them that are valid for 7 days.
Sign-in and passwords
Signing in with email requires a verified email address. Passwords are stored only as salted one-way hashes; new and changed passwords use PBKDF2-SHA256. Passwords must be at least 8 characters. You can also sign in with Google, Microsoft or Slack. Sessions expire 30 days after they were last used, and removing someone from an organization signs them out.
Our staff's access
Our support and operations staff use a separate admin system with its own accounts. Every change staff make, and every time they open a customer's leave data, is logged. Staff cannot sign in as a customer. Changes to production data go through reviewed, automated deployments; by policy, any other access to the production database is read-only. Staff working from outside the UK use cloud systems only and do not store customer data on their own devices.
Audit log
Absenca keeps an audit log of admin actions, such as balance adjustments and role changes. Admins can review it on plans that include it.
Application security
Every request is validated, webhooks from Stripe, Slack, Microsoft Teams and Google Chat are signature-checked, and every app sends security headers, including a Content Security Policy. Requests are rate limited. Every change is linted, type-checked and tested automatically before it can be merged.
Incident response
We have a written incident response process. If a breach affects your organization's personal data, we tell your admins without undue delay, and within 72 hours of becoming aware of it.
What we don't have yet
We are not certified to ISO 27001 or SOC 2, and no penetration test has been commissioned. Sign-in with SAML or OpenID Connect through your own identity provider is not available.
Reporting a vulnerability, and our vendors
Found a vulnerability? Please follow our vulnerability disclosure policy or write to security@absenca.com. The companies that process data for us are listed on our sub-processor page.