Security at OrgPlan
OrgPlan holds names, reporting lines, and salaries. Here's what protects them.
5-Level RBAC
Fine-grained role-based access control with five levels: Owner, Admin, Editor, Viewer, and Guest. Salary visibility is configurable per role and enforced server-side.
Encryption & Hardening
All traffic is encrypted in transit with TLS, and modern browser protections against clickjacking, injection, and cross-site attacks are on by default.
Audit Logging
Administrative and data-changing actions are recorded in a per-organization audit log, so you can see who changed what, and when.
Deletion & Recovery
Organization owners can cascade-delete all org data at any time, including employees, scenarios, and invite links. Soft delete provides a 30-day recovery grace period before permanent removal.
Public Sharing Controls
Share links are read-only with salary data, email addresses, and start dates automatically stripped. Domain-wide guest access gives controlled visibility without exposing sensitive fields.
Found a vulnerability?
We take all reports seriously. Please email security@orgplan.io with details and we’ll respond within 48 hours.