Separate company records
Your company’s records are kept separate from other companies' data in the database.
Security and privacy
How we look after your team’s data
See how Vacaydiary protects employee records, pay, sick notes and right to work documents, and how you can manage that data.
The short version
People see only what they should
Employees see their own records. Only your HR admins and directors see everyone’s.
Every change is recorded
The audit log shows who changed what and when, in plain English.
Backed up every night
Encrypted backups run daily, with daily, weekly and monthly copies kept.
Where we host your data
We manage the server that runs Vacaydiary’s database, sign-in, file storage, e-signing and email in the UK. Ask the developer to confirm the region. Service emails are sent from our own mail server.
- Stripe handles billing. It receives your billing contact, company name and number of people, never your HR records
- PostHog, on EU servers, helps us find and fix errors. Screen recording is off unless your workspace switches it on, and people can decline it
- Google or Microsoft are only involved if your team uses those sign-in buttons
Access that follows people’s roles
HR admins and directors manage the workspace. Employees see their own records, leave and documents, and their colleagues' approved time off. Notes, sick notes, pay and documents marked for HR stay with HR.
- Invite links work once and expire after seven days by default
- When someone leaves, their access ends on their last working day
- If our support team needs to look at your workspace to help, their access is read only and recorded
Tools for data requests
One person’s data
Download everything held about an employee as a file, for a subject access request.
Employees' own copy
Employees can download their own data from their account.
Your whole workspace
Download records, documents and photos in one ZIP file, with spreadsheets you can import elsewhere.
Erasing a leaver
Remove a leaver’s personal data when it no longer needs to be kept. Ask us to switch erasure on for your workspace.
Default retention periods
Technical detail
For your IT or security team
Security questions
Can’t see yours? Ask us
Neither is available yet. People sign in with an email and password, or with Google or Microsoft where you switch that on.
No. If you need more detail for your own checks, contact the team.
Only HR admins and directors can see individual salaries. A connected AI assistant can see department figures, including totals and medians.
No. We use data to provide Vacaydiary. Suppliers that help run the service are listed in our privacy policy.
To report a security issue or ask a question, email security@vacaydiary.com.
Try Vacaydiary with your team
Try every feature free for 14 days. Set up your workspace and invite your team when you’re ready.
Card required. Cancel before your trial ends to avoid a charge.