Security you can actually audit.
Payroll holds your most sensitive data: salaries, bank details and statutory identifiers. Vintage is built so that protection is the default, every change is traceable, and you can run it in our cloud or inside your own walls. This page sets out how.
Your sensitive data, encrypted by design
Encryption at rest
Statutory identifiers and sensitive fields are encrypted field by field. Each value is encrypted with its own key, and the master key is kept outside the database.
Encryption in transit
All traffic is served over TLS. Data moving between your browser, the app and the database is encrypted end to end.
Tenant isolation
Each organisation's data lives in its own database schema. Isolation is built into the structure, not left to a filter on a shared table.
Only the right people, only the right data
Role-based access (RBAC)
A two-stage permission model: what a role can see, and what it can do, down to the node and action, mapped to your org structure.
MFA & least privilege
Two-factor sign-in you can require for every user, and roles scoped to the least a person needs, down to own, team or assigned records.
Tamper-evident audit log
Each audit entry is chained to the one before, with who, when, from where, and the old and new values. Closed payroll periods stay exactly as filed.
An audit log that shows if it was changed.
Each entry carries a fingerprint of the one before it, so an edited or deleted entry breaks the chain and shows up when the log is checked. Filter by record or request number, and export to CSV for your auditors.
Single sign-on and automatic user set-up
SSO with OIDC or SAML
Sign in through your identity provider once your email domain is verified.
SCIM provisioning
SCIM 2.0 adds and removes users for you, so leavers lose access when your directory says so.
A fresh code for big actions
Exporting a whole company's data or connecting an integration needs a super admin and a fresh authenticator code.
Sessions can be listed and revoked, idle and absolute session limits are set per company, and requests are rate limited per user, company and IP address.
Data protection built into the product.
The privacy console records subject requests, consent and lawful basis, retention rules, your record of processing activities and breaches, with the 72-hour clock shown on each breach.
Compliant with how Nigeria works
Statutory rules are data you own, effective-dated and versioned, so a change in the law is a change you make, not a release you wait for.
Run it our way, or yours
Backups you can check
Daily backups kept 30 days, a monthly archive kept seven years, and a restore drill every month. Each company can see its own retention statement.
SaaS or on-premise
The same platform runs in our managed cloud or inside your own data centre under a signed licence. Your governance, your controls.
Responsible disclosure
To report a vulnerability, email security@vintageerp.com. We investigate every report and credit responsible researchers.
The questions buyers actually ask
In our managed cloud by default, with data-residency options, or fully on-premise inside your own infrastructure under a signed licence, if regulation requires it.
ISO 27001 certification is in progress. Today we already operate to its core controls: encryption, role-based access, MFA, audit logging and tenant isolation. We will publish the certificate once it is granted.
Sensitive fields are encrypted one by one, each with its own key, and the master key is kept outside the database. They are masked in the UI, and every access is logged.
Yes. Role-based access controls what each role can see and do, including row-level scope so managers see only their own team where configured.
They're immutable. What you filed stays exactly as filed, and the audit trail records every change that led there.
Yes, OIDC and SAML once your email domain is verified, and SCIM to add and remove users.
Daily backups for 30 days and a monthly archive for seven years, with a monthly restore test.
Set up access & protection
Single sign-on and SCIM
Verify your domain, connect OIDC or SAML, provision users.
Data protection under the NDPA
The privacy console tabs and the breach clock.
Roles & access control
A two-stage model: what each role can see, and what it can do.
Two-factor authentication & sessions
Protect privileged access with MFA and see every device that's signed in.
Want the full security overview?
Talk to us for the security pack, the DPA, and answers for your IT and compliance teams.