Security at LeaveVia

Every organisation's data belongs to its own workspace. Isolation is enforced in the database itself, not only in the application, so a request can only ever return data belonging to the workspace the user is a member of.

• Owners and administrators manage workspace configuration, employees and policies.
• Managers see the information needed to approve requests for the people they manage.
• Employees see their own leave, balances and history.
• Colleagues may only see that someone is away — sensitive leave detail is restricted by role.

Access rules are applied at the data layer using row-level security, and are enabled on every application table. Authorisation decisions are made server-side; the browser is never trusted to decide what a user may read or change.

The leave ledger is designed to be immutable: entries cannot be edited or deleted, and every correction, cancellation or modification is recorded as a new, traceable entry. Significant actions — approvals, role changes, invitation acceptance and administrative corrections — are recorded in an activity trail so administrators can see what happened and when.

Sign-in supports email and password with email confirmation, password reset, and provider-based sign-in. Invitations are single-use, time-limited and rate-limited, are delivered only to the invited work email address, and are accepted atomically so an invitation can never grant more access than it was issued for.

Traffic between your browser and LeaveVia is encrypted in transit. Data is stored in a managed database provided by our hosting platform. Credentials for optional calendar integrations are held encrypted and are only used server-side to publish approved leave; they are never exposed to the browser.

Notification email is intentionally minimal: it identifies the workspace and the action needed and links back to the application instead of reproducing sensitive leave detail. Calendar publication is one way and limited to availability information — it does not publish leave reasons. LeaveVia remains the source of truth for leave records.

• Least-privilege access for personnel who operate and support the service.
• Secrets and integration credentials are managed outside application code.
• Automated regression checks run against the security and data-integrity rules before changes ship.
• Background delivery of notifications and calendar updates is idempotent, so retries cannot duplicate or corrupt records.

LeaveVia does not hold ISO 27001, SOC 2 or any other third-party security certification, and we make no such claim. No service can guarantee absolute security. If you believe you have found a vulnerability, please report it through the Contact page and do not test against other organisations' data.