Salary++ and ISO 27001: How We Protect Worker Data

Earned Wage Access runs on some of the most sensitive data a company holds: who worked when, what they earned, and where their salary goes. InOps, the company behind Salary++, is certified to ISO/IEC 27001, the international standard for information security management. Here is what that means for employers and workers.

What data Salary++ uses

• Worker identity and contact details
• Attendance records from biometric devices, face readers or apps
• Earned wage calculations
• Bank account details for transfers
• Withdrawal and recovery records

What ISO/IEC 27001 means

ISO/IEC 27001 certifies that an organisation runs a managed system for information security. It covers:

• Identifying and assessing information security risks
• Access controls, so only authorised people see data
• Secure handling, storage and transfer of data
• Incident management and response
• Regular internal audits and independent external audits

How we apply it to Salary++

• Role-based access for employer, contractor and InOps staff
• Encryption of data in transit and at rest
• Data shared with the lending partner only as needed, with worker consent
• Logging of access and changes
• Defined processes for data correction and deletion requests

Data protection and consent

Workers are told what data is used, why, and with whom it is shared. Consent is taken at enrolment. This follows the principles of India's Digital Personal Data Protection Act.

Questions employers should ask any EWA provider

• Are you ISO/IEC 27001 certified? Can we see the certificate scope?
• Where is data stored?
• Who can access worker data, and how is access logged?
• What data goes to the lender?
• How are security incidents reported to us?