How we protect your team's data

Personal information categories covered

Identity, contact, account credentials (hashed by our authentication provider — WalnutsHR never holds plaintext passwords), employee HR records (with sensitive fields encrypted at application layer), performance and time-off data, uploaded documents, support communications, AI prompt content (only when invoked), and device / network / usage metadata (only with explicit analytics consent).

Destination jurisdictions assessed

United States, for all sub-processors listed in our Privacy Policy §4.2 except Upstash (Canada primary). The assessment covers US federal law (no comprehensive privacy statute; sectoral protections only; CLOUD Act and FISA §702 exposure acknowledged), the state-law layer (CCPA/CPRA and successors), and a per-recipient analysis of each sub-processor's contractual, technical, and organizational safeguards.

Operational mitigations in production

• Standard Contractual Clauses (or equivalent) with every US-based sub-processor
• Application-layer AES-256-GCM encryption for SIN, bank account, and bank transit numbers, in addition to the cloud provider's at-rest encryption
• Postgres row-level security on every model; column-level revocation of salary, SIN, bank, and tax fields from the public-API role
• Sentry payload scrubbing strips password, SSN, bank, salary, token, and authorization headers before transmission
• AI invocations only on explicit user action; prompt content fenced; no background AI processing of Quebec residents' data
• Explicit, granular consent captured at signup with audit trail (purpose, policy version, IP address, timestamp)
• Customer-data deletion lifecycle: 60 days paused → 270 days archived → 30 days final notice → permanent deletion; backup purge within 30 additional days

Residual risks acknowledged

US government compulsion under the CLOUD Act, FISA §702, or domestic process remains a theoretical exposure for all US-based sub-processors; mitigated by encryption-at-rest, contractual notification requirements where lawful, and the narrow scope of HR data (small/mid-size employers; not typical compulsion targets). Sub-processor breach risk is mitigated by SOC 2 Type II certifications and our layered technical controls but cannot be eliminated. AI provider prompt retention is the highest-attention residual; we reassess every six months and will route Quebec-customer AI invocations to a Zero-Data-Retention vendor if one becomes available with comparable capability.

Conclusion (pre-publication)

Personal information transfers to the recipients listed in Privacy Policy §4.2 are assessed as receiving adequate protection within the meaning of Article 17 of the Act, conditional on the operational mitigations above remaining in force and on the annual PIA review cycle (next: 2026-05-18 + 12 months) being followed. This conclusion is subject to counsel review before being treated as final.

Privacy Officer + complaints

Quebec residents with questions about this assessment, or who wish to challenge any cross-border transfer of their personal information, may contact the WalnutsHR Privacy Officer at privacy@walnutshr.com. Complaints unresolved through that channel may be filed with the Commission d'accès à l'information du Québec.