Security & GDPR

Your HR data is some of the most sensitive in your business. We take that seriously — with UK data residency, end-to-end encryption, full audit logging, and GDPR compliance built in from day one.

Built to the standards that matter. UK-based, GDPR-ready, and certified against recognised security frameworks.

In progress

Cyber Essentials Plus

Certified against the UK government-backed cyber security standard. Covers boundary firewalls, secure configuration, access control, malware protection, and patch management.

Active

UK data residency

All customer data is stored and processed on servers located in the United Kingdom. No data leaves the UK without your explicit consent.

Active

GDPR compliant

Built to meet UK GDPR and the Data Protection Act 2018 from day one. Data minimisation, lawful processing, and clear data subject rights.

Aligned

ISO 27001 aligned

Internal security controls follow ISO 27001 principles covering access management, incident response, change management, and business continuity.

How we protect your data. Eight layers of protection covering everything from login to audit log.

Encryption in transit

Every request is encrypted with TLS 1.3. HTTPS enforced site-wide with HSTS. No downgrade attacks possible.

Encryption at rest

Your data is encrypted at rest using AES-256. Uploaded files and database storage are both encrypted.

Multi-factor authentication

Enforce 2FA for all users via authenticator apps, passkeys, or SMS. Admin-configurable per company.

Role-based access control

Granular permissions with custom roles. Policies inherit through your org structure, so access follows your team's actual shape.

Full audit logging

Every state change is logged with who, what, when, and where. Audit logs are immutable and exportable for compliance reviews.

Session security

Sessions expire automatically, admins can revoke sessions centrally, and suspicious activity triggers re-authentication.

Anonymous reporting

Safeguarding and wellness reports support true anonymity. Identity is never exposed, even to admins.

Secure e-signatures

Digital signatures with cryptographic audit trails. Every signed document retains IP, timestamp, and user context.

Your GDPR rights, built in. Every employee gets the rights UK GDPR gives them — and they can exercise them without filing a request.

Right to access

Employees can request a full export of their personal data at any time. Admins can generate exports per employee in one click.

Right to erasure

Delete employee records when they leave, with configurable retention for legal or tax obligations. Soft-delete with permanent purge.

Right to rectification

Employees can update their own profile data. Changes are logged and auditable.

Right to portability

Export employee data in machine-readable formats (CSV, JSON) for transfer to other systems.

Security, in action. Retention schedules that enforce themselves and 2FA that blocks logins until admins enrol.

Retention schedule
Auto-enforced
  • Audit log

    7-year retention

    Expiring · 255d
  • Expense receipts

    6-year (HMRC)

    Expiring · 190d
  • Employee records · ex-staff

    2 years post-departure

    150d left
  • Session tokens

    30 days inactive

    28d left
  • Soft-deleted records

    30-day recovery window

    4d left
Every record has a retention clock. When it hits zero, Luna purges it — no manual cleanup, no quiet drift.

01

Retention that enforces itself

Every data type has a retention clock — audit logs for seven years, expense receipts for six (HMRC), ex-employee records for two. When the clock hits zero, Luna purges the record and writes an audit entry. No manual cleanup, no quiet drift past policy.

2FA enforcement
Required for admins

Signing in · Sarah Mitchell

Password••••••••••
6-digit code from authenticator
·

Team enrolment

4/ 6 enrolled2/3 admins
  • SM

    Sarah Mitchell

    Admin

    Head of Finance

    2FA on
  • OC

    Olivia Chen

    Admin

    Engineering Lead

    2FA on
  • TP

    Tom Parker

    Operations

    2FA on
  • SM

    Sofia Marin

    Admin

    HR Business Partner

    Login blocked
  • HW

    Hana Weiss

    Finance Analyst

    2FA on
  • JP

    Jamal Price

    Warehouse

    Enrol required

02

2FA required where it matters

Multi-factor authentication is required for every admin — no exceptions. Non-enrolled admins are blocked from login until they set up an authenticator. A team-wide enrolment grid shows who still has work to do.

Policies & agreements

Review our full legal documents for the details on data processing, cookies, and service terms.

Ready to modernise your HR?

Join growing UK businesses who've switched to Luna HR.