"Is it safe to keep HR data in the cloud?" is the question almost everyone asks, and almost never the one that matters. A server sitting in a closet down the hall isn't automatically safer than one in the cloud -it's usually a good deal less safe, because nobody patches it with the discipline of a specialized provider. The question that actually decides whether your HR data is protected isn't where the server lives, it's how access to the data on it is designed. That holds even when the underlying infrastructure -encryption in transit, data centers, backups- is identical between two vendors: the difference sits one layer up, in who is allowed to see what.
Two companies can run on the exact same cloud infrastructure and have very different security postures, because real security lives in two places: isolation between organizations, and permissions within each one.
Isolation between companies, not just between servers
Cantevia is multi-tenant: each company has its own data, and even its own file storage, isolated from every other company on the platform. That matters especially for sensitive documents -contracts, payslips, occupational health records- where a failure of isolation isn't a visual bug, it's another company's data leaking out. Asking "are my files stored separately, or just tagged as mine inside one shared bucket" is a more useful question than "do you use the cloud."
Permissions with a level and a scope, not a generic "admin"
Within a single company, the more common risk isn't an outside attack -it's someone seeing or editing data that isn't theirs to touch. A team manager shouldn't see their reports' personal details or emergency contact -that should only be visible to the person themselves or to HR. Granular permissions per module, with a level (read, write, admin) and a scope (own, team, company-wide) configurable per role, make that distinction possible with precision, instead of the typical admin/editor/viewer split that can't tell "can see the org chart" apart from "can see someone else's payslip."
Security also means not over-exposing data by default
There's a design signal worth checking in any demo: whether protected personal data -an emergency contact, information tied to health monitoring- is visible by default to any manager, or whether it requires an explicit permission.
In Cantevia, that data is only visible to the person themselves or to HR, never to a direct manager unless their role explicitly grants that permission. It's the same principle as isolation between companies, applied within a single one: nobody sees more than their role needs to do the job, not one field more.
What not to accept at face value
Be wary of security claims that can't be checked: certifications that don't exist, third-party audits nobody can actually see. What can be checked is the design itself: whether isolation between companies is real, whether permissions distinguish levels and scope, and whether a manager can, in practice, see data they shouldn't.
The cloud isn't the risk or the guarantee. The risk is whether someone who shouldn't see a piece of data can get to it in two clicks.