cink holds some of the most sensitive information a business has — Tax File Numbers, bank details, superannuation, signed contracts and compliance records. This page explains, in plain language, the concrete steps we take to protect it. For the legal detail on what we collect and why, see our Privacy Policy.
The short version
- Tax File Numbers, bank and super details are encrypted, and deleted permanently once they've reached your payroll system — we don't keep them "just in case".
- There are no passwords to steal, phish or reuse. Login is a one-time code sent to your email.
- Every business's data is walled off from every other business's, enforced on every request.
- Documents (contracts, ID, compliance certificates) can't be accessed via a public link — every download is checked against who you are and what your role allows.
- Sensitive actions are logged, so there's a record of who did what.
1. Protecting sensitive employee data
Tax File Numbers, bank account details and superannuation information are encrypted using AES-256-GCM — a strong, industry-standard encryption algorithm — from the moment an employee enters them. They stay encrypted in our database and are decrypted, in memory, only when they're used: when HR runs the payroll sync, or when an HR manager opens them to enter into a payroll system cink doesn't connect to — every opening is recorded in the audit log. Once they've reached payroll (the sync succeeds, or HR marks them entered) they are permanently deleted from cink, and details nobody has updated for 90 days are deleted regardless — we don't retain a copy once your payroll system has it.
All data sent to and from cink, including logins and file uploads, travels over an encrypted connection (TLS 1.2 or higher). Email is the exception we can't fully control: notifications, and contracts sent for signing, are delivered by email, and whether the last leg into the recipient's inbox is encrypted depends on their email provider. Tax File Numbers and bank details are never sent by email.
2. Login and access control
cink is passwordless by design. Instead of a password, you log in with a one-time code sent to your email address, which expires after a short window and locks out after repeated failed attempts. This removes an entire category of risk — there's no password to be reused from another breached site, guessed, or phished from you.
Sessions expire automatically and need re-authentication. Every screen and action is governed by role-based permissions, so a roster manager, HR professional and org admin each see only what their role allows.
3. Data isolation between businesses
cink is multi-tenant — many businesses share the same application — but every piece of data is tagged to a single organisation, and every request is checked server-side to ensure it can only ever touch that organisation's own data. This isolation is covered by automated tests that run on every change we ship, specifically designed to catch any cross-business data leakage before it could reach production.
4. Document security
Contracts, ID documents, compliance certificates and other files are never exposed via a public or guessable link. Every single download is served through an authenticated request that re-checks who you are, which organisation you belong to, and whether your role is allowed to see that specific document — every time, not just at upload.
5. Audit trail
Sensitive actions — such as emergency ("break-glass") logins and changes to an organisation's account — are recorded in an audit log capturing who performed the action, what it was, and when. This gives us and, on request, our customers a verifiable record for security review.
6. Data retention and deletion
Tax File Numbers, bank and super details are deleted as soon as they've reached payroll (or after 90 days without an update), well before the general retention period below. For everything else, we retain records for up to seven (7) years while you remain a customer, consistent with Australian record-keeping obligations for employment and payroll records (Fair Work Act 2009). If you leave cink, you can export your data, and once handed over we delete or de-identify what we hold, except where the law requires us to keep it. Full detail is in our Privacy Policy.
7. Hosting, data residency and backups
| Component | Provider & region |
|---|---|
| Database | MongoDB Atlas — Australia (Sydney and Melbourne) |
| Document storage | Cloudflare R2 — Oceania region |
| Application hosting | Render — Singapore |
We take continuous backups of customer data. As part of our Business Continuity Plan, we're scheduling a full, real restore of those backups — not just a check that a backup job reported success — and will run that restore test at least once a year going forward.
8. Data breach response
If a data breach occurs that is likely to result in serious harm, we assess it and, where required, notify affected individuals and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme. Full detail is in our Privacy Policy.
9. Questions?
If you're evaluating cink as part of a security or vendor-risk review and have questions not answered here, get in touch — we're happy to walk through our approach in more detail.