cink holds some of the most sensitive information a business has — Tax File Numbers, bank details, superannuation, signed contracts and compliance records. This page explains, in plain language, the concrete steps we take to protect it. For the legal detail on what we collect and why, see our Privacy Policy.
The short version
- Tax File Numbers, bank and super details are encrypted, and deleted permanently once payroll setup is complete — we don't keep them "just in case".
- There are no passwords to steal, phish or reuse. Login is a one-time code sent to your email.
- Every business's data is walled off from every other business's, enforced on every request.
- Documents (contracts, ID, compliance certificates) can't be accessed via a public link — every download is checked against who you are and what your role allows.
- Sensitive actions are logged, so there's a record of who did what.
1. Protecting sensitive employee data
Tax File Numbers, bank account details and superannuation information are encrypted using AES-256-GCM — a strong, industry-standard encryption algorithm — from the moment an employee enters them. They stay encrypted in our database and are only ever decrypted, in memory, at the point HR runs the payroll sync. Immediately after that sync succeeds, the plain-text values are permanently deleted from cink — we don't retain a copy once your payroll system has it.
All data sent to and from cink, including logins and file uploads, travels over an encrypted connection (TLS 1.2 or higher). Nothing is ever transmitted in the clear.
2. Login and access control
cink is passwordless by design. Instead of a password, you log in with a one-time code sent to your email address, which expires after a short window and locks out after repeated failed attempts. This removes an entire category of risk — there's no password to be reused from another breached site, guessed, or phished from you.
Sessions expire automatically and need re-authentication. Every screen and action is governed by role-based permissions, so a roster manager, HR professional and org admin each see only what their role allows.
3. Data isolation between businesses
cink is multi-tenant — many businesses share the same application — but every piece of data is tagged to a single organisation, and every request is checked server-side to ensure it can only ever touch that organisation's own data. This isolation is covered by automated tests that run on every change we ship, specifically designed to catch any cross-business data leakage before it could reach production.
4. Document security
Contracts, ID documents, compliance certificates and other files are never exposed via a public or guessable link. Every single download is served through an authenticated request that re-checks who you are, which organisation you belong to, and whether your role is allowed to see that specific document — every time, not just at upload.
5. Audit trail
Sensitive actions — such as emergency ("break-glass") logins and changes to an organisation's account — are recorded in an audit log capturing who performed the action, what it was, and when. This gives us and, on request, our customers a verifiable record for security review.
6. Data retention and deletion
Tax File Numbers and bank details are deleted as soon as payroll setup is complete, well before the general retention period below. For everything else, we retain records for up to seven (7) years while you remain a customer, consistent with Australian record-keeping obligations for employment and payroll records (Fair Work Act 2009). If you leave cink, you can export your data, and once handed over we delete or de-identify what we hold, except where the law requires us to keep it. Full detail is in our Privacy Policy.
7. Hosting, data residency and backups
| Component | Provider & region |
|---|---|
| Database | MongoDB Atlas — Australia (Sydney and Melbourne) |
| Document storage | Cloudflare R2 — Oceania region |
| Application hosting | Render — Singapore |
We take continuous backups of customer data. As part of our Business Continuity Plan, we're scheduling a full, real restore of those backups — not just a check that a backup job reported success — and will run that restore test at least once a year going forward.
8. Data breach response
If a data breach occurs that is likely to result in serious harm, we assess it and, where required, notify affected individuals and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme. Full detail is in our Privacy Policy.
9. Questions?
If you're evaluating cink as part of a security or vendor-risk review and have questions not answered here, get in touch — we're happy to walk through our approach in more detail.