How we treat your data
Leave records are HR data — sensitive, personal, occasionally medical. We treat them that way. Encrypted, locked down, only visible to people who actually need to see them, and never used for anything you didn't sign up for.
HTTPS in transit, encrypted at rest, GDPR-ready by design, three-role permission model with delegation that expires on its own. The defaults err on the side of less exposure.
The thing that separates good privacy from theatre is what happens by default. Reason fields aren't shared. Medical leave shows as "out of office", not the diagnosis. The defaults err on the side of less exposure.
Every connection to Vacation Flow goes over HTTPS, and everything we store is encrypted at rest — including backups. The fundamentals were in place before the first customer signed up.
Fundamentals in place before the first customer signed up.
The European data-protection rules shaped how we built the platform. Consent is explicit. Customers can request a data export or full deletion at any time, and we'll honour either request promptly.
We don't sell it, and we don't use it to train anything. When you decide to leave, we hand back a clean export in the format you ask for and delete our copy on request. No retention games, no exit fees, no "but you'll lose access to insights".
Three roles cover what most companies need: Employee, Manager, Admin. Defaults are sensible enough that most teams never touch them — employees see their own stuff, managers see their team's, admins see everything. If you do want to dig in, every permission is editable. A common case worth knowing about: a manager can delegate approvals while they're on leave without handing over balances or HR data, and the delegation expires the day they're back.
The thing that separates good privacy from theatre is what happens by default. In Vacation Flow, reason fields aren't shared with teammates. Medical leave shows up as "out of office" in the team view, not as the diagnosis. Admins see balances but not why someone took the day. You can loosen any of that if your culture wants more openness — but the defaults err on the side of less exposure, because that's the version you can't accidentally regret.
The defaults you can't accidentally regret.
Encrypted, GDPR-ready, three roles that map to how teams actually work, privacy that protects what should stay private.
