Security
Who sees what, and what happens to your data
Absentra records no more than it needs and gives everyone access that fits their role. Administration and medical information stay separate.
Questions to ask before you choose
Short and factual: this is how Absentra works today.
- Who sees which cases?
- Administrators, HR employees and case managers work in all cases of the organisation. You can optionally assign a team lead to a case; they then only see the cases assigned to them, without being able to change them, and can update the status of their own tasks. The employee list is visible to all users within the organisation. For each case the audit log shows what happened, when and by whom.
- How does two-step verification work?
- In addition to your password, you sign in with a code from an authenticator app on your phone. Signing in and password recovery are also protected against automated attempts.
- How are organisations kept apart?
- Each organisation only sees its own data. That separation is enforced in the database itself, not just in the app, and we check it with an automated isolation test. The public demo is completely separate from the environment customers work in.
- What happens to our data if we stop?
- Absentra does not have an export button yet. If you stop, we arrange the handover and deletion of your data with you. How that works is agreed before you work with real data.
- Which suppliers are involved and what do we agree?
- Absentra uses Supabase for the database and sign-in, Vercel for hosting and Resend for email. Cloudflare Turnstile protects sign-in and password recovery. Agreements on data processing are put in writing with you before you enter real data.
What data does Absentra record?
Absentra has no fields for diagnoses, symptoms, treatments, medical notes or causes of illness.
What Absentra does record
- which employee it concerns
- start and end date
- administrative status
- department or team
- outstanding administrative actions
What Absentra does not record
- diagnosis
- symptom
- treatment
- medical note
- cause of illness
This is the current product scope, not a complete legal data list. Note: the administrative sick and recovery notifications that Absentra does record may qualify as data concerning health under the GDPR. We protect them accordingly and ask for no more than we need.
Only what we can back up
We do not mention certifications, backup guarantees or data locations we cannot demonstrate. If you ask about them, you get an honest and concrete answer.
How the contact form is protected
The requests you send through this website are protected as well.
- Checks on the server: we match every request against a fixed schema and reject fields that do not belong there.
- Bot detection: Vercel BotID checks every submission before any email goes out.
- Origin checks: we only accept requests sent from this website.
- Honeypot and limits: we quietly ignore automated submissions and turn away oversized requests.
- Minimal logging: what you type never reaches the log files, and error messages carry no technical detail.
Responsible disclosure
Found a possible security issue in the website or the demo? Report it confidentially and we will pick it up as quickly as we can. Do not include employee data or other personal data in your report.
Email your report to contact@absentra.nl with the subject “Beveiligingsmelding Absentra”.
Questions about security or data processing?
Feel free to ask, also as part of your request. You get an answer from the person who builds Absentra.