Security overview

1.Two-factor authentication

Every staff and administrator account must sign in with a password and a six-digit code from an authenticator app. Members are strongly encouraged to do the same. Recovery codes let you back in if you lose your phone, and each code works once.

You can turn it on, change device or review your recovery codes on the two-factor page. If you ever lose both your device and your codes, our recovery process verifies you by hand before restoring access.

2.Sign-in and session protection

• Passwords are at least 10 characters and are stored only as salted, slow hashes, never in readable form.
• Repeated failed attempts slow down and then lock the sign-in, and the account owner is alerted.
• A new device or location triggers an email alert, and every device you are signed in on is listed so you can end sessions.
• Idle staff sessions end after 30 minutes, and the lock screen hides the panel after 15 minutes without activity.

3.Encryption in transit and at rest

All traffic between your browser and SmartHR MLM uses TLS 1.3 with HTTP Strict Transport Security, so connections cannot be downgraded. Databases, file storage and backups are encrypted at rest with AES-256.

Encryption keys are kept in a managed key vault, separate from the data they protect, and rotated every year or immediately if there is any doubt. Sensitive fields, such as bank details, are encrypted a second time inside the application.

4.KYC document handling

Identity documents are the most sensitive data we hold, so they are handled separately from everything else.

• Uploads go straight to a private, encrypted store. They are never placed in public folders or sent by email.
• Only staff with the KYC review role can open a document, each view is written to the audit log, and screenshots of the viewer are watermarked with the reviewer's name.
• Documents are kept for five years after an account closes, as anti-money-laundering rules require, and are then securely deleted.
• Members never see each other's documents, and a sponsor only learns whether a downline member is verified.

5.Payout safeguards

Money leaving the platform has the strictest controls.

• Approval limits: a payout batch is prepared by one person and approved by another administrator. Withdrawals above a member's limit need a second approval.
• Hold periods: new bank details and new devices put a 48-hour hold on withdrawals, so a hijacked account cannot be emptied at once.
• Verified destinations: payouts go only to accounts that match the verified name on the member's KYC record.
• Risk checks: every withdrawal gets a risk score, and unusual amounts or patterns are paused for manual review.

6.Audit logging

Every sign-in, permission change, export, approval and edit to a financial record is written to a tamper-evident audit log with who, what, when and from which address. Entries cannot be edited or deleted by administrators, and security warnings are shown to Super Admins first. Logs are kept for at least one year, and records of money movements for seven.

7.Access roles

Staff get the least access they need to do their job. Roles such as Finance Manager, Compliance Officer and Support Agent grant specific permissions, and nobody else can use them. Super Admin is limited to a small number of people. Access is reviewed every quarter, and a person who changes team or leaves loses their permissions the same day.

8.Infrastructure and backups

• The platform runs in ISO 27001 certified data centres, spread over several zones so one failure does not stop the service.
• Networks are segmented, production is separate from testing, and servers are patched on a fixed schedule.
• Encrypted backups run every night at 03:00 and are kept for 30 days. We restore them to a clean environment every quarter to prove they work.
• Code is reviewed before release, dependencies are scanned for known vulnerabilities, and an independent firm tests the platform each year.

9.Incident response

We monitor the platform around the clock. If something goes wrong, a trained on-call team contains the problem, finds the cause and fixes it. If personal data is affected we tell the people involved and the regulator without undue delay and within 72 hours where the law requires it, explain what happened and what to do next, and publish what we changed afterwards.

10.Responsible disclosure

If you find a vulnerability, please tell us before you tell anyone else. Email security@smarthr-mlm.com with the steps to reproduce it. We acknowledge reports within two working days and keep you updated until it is fixed.

• Test only your own accounts and do not access, change or destroy other people's data.
• Do not run denial-of-service tests or use social engineering against our staff or members.
• Give us reasonable time to fix the issue before sharing details publicly.