top of page

Security & compliance

Employee Data Deserves Careful, Controlled Handling.

HR Operations involves sensitive employee information. Our approach is built around agreed access permissions, documented procedures, responsible data handling and clearly defined responsibilities.

image.png

Access control

  • Unique user identities for every team member

  • Multi-factor authentication where supported

  • Role-based access aligned to job responsibilities

  • Least-privilege permissions by default

  • Periodic access reviews

  • Timely access removal when roles change or people leave

image.png

Endpoint & workspace security

  • Company-managed devices where required

  • Device encryption and endpoint protection

  • Automatic screen-lock controls

  • Approved software only

  • Secure remote-working practices

  • Physical workspace practices appropriate to the work

image.png

Data handling

  • Data minimisation — only what the process requires

  • Work performed inside client-approved systems

  • Documented retention and deletion instructions

  • Restricted sharing on a need-to-know basis

  • Secure incident escalation procedures

  • Subprocessor oversight where subprocessors are used

image.png

Governance

  • Employee confidentiality obligations

  • Security-awareness training

  • Incident-response procedures

  • Business-continuity planning

  • Contractual data-processing arrangements

  • Cooperation with client security assessments

International data protection

Serving US and UK businesses from Bengaluru means cross-border data handling is part of every engagement. Data-processing and international-transfer arrangements are assessed for each engagement and applicable jurisdiction — including UK GDPR requirements and the legal arrangements relevant to US and Indian operations.

​

Before any processing begins, the client and Northbridge HRO agree on responsibilities in writing: what data is accessed, where it is processed, who may access it and how long it is retained.

image.png

Our commitments, stated honestly

  • We do not claim ISO 27001, SOC 2 or GDPR certification unless it has been independently obtained and is current.

  • No technology platform alone makes any organisation compliant — compliance comes from agreed controls, consistently operated.

  • No provider can promise that incidents can never occur. We commit to prevention, detection and clear response procedures.

  • Where a control is planned rather than yet implemented, we will say so plainly during the assessment process.

bottom of page