HR software security: who can access employee data, what they see and when

How do you design access to HR data?

Access design starts from the principle of least privilege: each user reaches only the records they need to do their job. Roles are first derived from job descriptions and then assigned to people. Make no exceptions for individuals; if a need is permanent, define a new role instead.

1. Classify the data. General employee details, pay and payroll, special category documents, and candidate and performance records are separate access groups.
2. Draw up a role table. For employee, team manager, HR, system administrator and company owner, write down what each can read and what each can change.
3. Set the scope. The same permission can apply to the whole company, to one's own team or only to one's own record.
4. Separate technical administration from data. The person who creates user accounts does not need to see salaries; segregation of duties starts here.
5. Strengthen authentication. Make two-step verification mandatory for everyone who reaches sensitive data.
6. Monitor and clean up. Review the audit log regularly and close unused roles and accounts.

Which security questions should IT ask when choosing HR software?

The ten questions below are vendor-neutral and apply to any HR software. The last column gives Sora İK's answer, based only on what the sora-ik.com security page publishes; topics not yet published there are flagged as such.

What does KVKK require for the security of HR data?

Article 12 of KVKK (Türkiye's Personal Data Protection Law No. 6698) requires the data controller to take technical and organisational measures at an appropriate level of security to prevent unlawful processing and access and to safeguard the data. The Authority prescribes no single model; measures follow the nature of the data and the company's risk.

The same article holds the data controller jointly responsible with anyone who processes the data on its behalf, so the measures of an HR software provider are the employer's concern too. If data is obtained unlawfully, the data controller notifies the person concerned and the Board as soon as possible.

When choosing measures, the Authority's Personal Data Security Guide (Technical and Organisational Measures) is the reference point. The text of the law is in the Legislation Information System, and the Authority's summary of the article is on its data security obligations page (both in Turkish).

Where do Excel and shared folders leave HR data exposed?

Spreadsheets and folders grant access at file level: whoever opens the file sees everything. Nothing records who opened what, leavers' access is forgotten and password sharing becomes routine. Most gaps come not from attacks but from these everyday habits.

• The payroll sheet is a single file; you cannot grant permissions by row or column.
• Once the file is forwarded by email, the number of copies and recipients is out of control.
• The shared folder password is passed around the team and not changed when someone leaves.
• There is no change history; nobody can find out who edited a pay line.
• When the laptop the file was downloaded to goes missing, nobody knows who has the data.

How do roles, permissions and security work in Sora İK?

In Sora İK, roles decide access: employee, team manager, HR, system administrator and company owner come built in, and you can add company-specific roles when needed. Two-step verification can be made mandatory company-wide, and views of sensitive data and changes are written to the audit log.

• Segregation of duties: the system administrator manages users and roles but, by default, does not see pay, payroll, special category documents, performance or candidate records.
• Custom roles: roles for users such as a certified public accountant or payroll specialist are built from the permission list; a company can have up to 50 custom roles.
• Against privilege escalation: nobody but the company owner can hand out a permission they do not hold, and nobody can assign a role to themselves.
• Data scope: the whole company, one's own team or only one's own record.
• Audit log: cannot be edited or deleted from the interface and downloads as CSV; successful and failed sign-ins are logged separately.

On the roadmap: a screen to list and end active sessions, a report of who can view a given employee's pay, department or location scope, field-level permissions and automatic account closure on the leaving date. The Sora İK hub page gives an overview of the product; details: Roles, Permissions & Security — full feature list.

How should IT keep HR software secure over time?

Security does not end with the checklist at purchase; permissions widen over time and nobody narrows them again. Tying the account lifecycle to HR processes, monitoring sensitive access regularly and keeping external users in separate roles are the three pillars of lasting security.

• Add account creation and closure to the onboarding and offboarding checklists; an exit is not complete until the account is closed.
• Give external users such as an accountant a separate role that sees payroll only, and close the account when the engagement ends.
• Consider exporting the audit log as CSV and keeping it in your central log system.
• Write down where recovery codes are kept and who can reset two-step verification.
• Team scope comes from the manager link; if the org chart is wrong, permissions are wrong too.

We cover authentication and conditional access in the Microsoft 365 security settings checklist, KVKK's technical measures in the KVKK technical measures checklist and the network side of least privilege in our zero trust network access (ZTNA) article. For the legal framework, see the KVKK in HR guide.

Modules that work with roles and permissions

Permission rules only make sense alongside the data they protect. The guides below show how the same principles apply to KVKK, personnel records, payroll and approval workflows.

• KVKK in HR guide: KVKK compliance for employee and candidate data: privacy notices, legal bases, retention, destruction and access.
• Digital personnel file guide: Document groups, steps for moving from paper to digital and access rules for managing personnel files.
• Payroll preparation guide: The four-step payroll cycle in Türkiye, from the attendance ledger to the payslip, with a month-end checklist.
• HR approval workflow guide: Designing leave and document approval flows with steps, roles, conditions and delegation rules.

Frequently asked questions

What is role-based access control in HR software?

Role-based access control (RBAC) is an access model in which permissions are given to jobs, that is roles, rather than to individuals. A user is assigned a role and receives its permissions; when the job changes, only the role changes. In HR, this keeps sensitive data such as pay and health details manageable, open only to those whose work requires it.

Can two-step verification be made mandatory for all users?

In most business software an administrator can switch this on; when evaluating, ask whether the requirement applies per role or company-wide. In Sora İK, the company owner can make two-step verification mandatory for everyone in the company; users enter the one-time code generated by an authenticator app and receive recovery codes as a backup.

What should an HR audit log record?

A good audit log records who acted, the type of action, the record affected and the time; it logs not only changes but also views of sensitive data. In Sora İK, critical actions are recorded with this information, and views of pay, payroll, candidate and performance records, ID number displays and document downloads are logged too. Before-and-after values for changed fields are on the roadmap.

Who outside HR should see payroll data?

In principle, only the people who prepare, approve and pay the payroll. A system administrator or department head does not need to see pay details, even with technical or administrative authority. For an external certified public accountant, open a separate role with read-only payroll access, and close the account when the engagement ends.

Is cloud-based HR software secure?

Security depends less on where the data sits than on how it is protected: encrypted connections, strong password storage, two-step verification, role-based access and an audit log. Check whether the provider publishes these in writing and discloses its sub-processors and hosting details. An unprotected spreadsheet on a company server should be judged by the same criteria.