Information Security at Hive

As part of our ISO/IEC 27001:2022 certified Information Security Management System, HiveHR maintains a comprehensive suite of security and compliance policies covering key operational areas:  

• Core Security & Access Management: Includes the Information Security Policy, Acceptable Use Policy, Access Control Policy, Password Policy, and Physical Security & Clear Desk Policies.  
• Device, Working Practice & Modern Technology: Includes the BYOD Policy, Mobile Device, Teleworking & Working Abroad Policy (HiveRoam), and AI Use Policy.  
• Data Protection & Infrastructure: Includes the Data Management Policy, Cryptographic Controls Policy, Backup Policy, Network & Firewall Configuration Policy, and Secure Development Policy.  
• Risk, Incident & Supplier Governance: Includes the GDPR Breach & Information Security Incident Management Policy, Business Continuity & Disaster Recovery Policy, Business Risk Policy, and Supplier Relationship Policy.

HiveHR utilises a multi-layered security framework aligned with ISO/IEC 27001:2022 and UK GDPR to safeguard data. Information is protected using AES 256 encryption at rest and TLS 1.2 or higher for transit, hosted within secure AWS infrastructure. Digital safeguards include Role-Based Access Control (RBAC) following least privilege principles, multi-factor authentication (MFA), and mandatory password management. Security is maintained across the data lifecycle through classification, automated backups, endpoint protection, and physical controls such as clear desk practices and restricted office access.

The data is stored and backed up in Dublin, Ireland.

Hive provides a range of methods that allow users to sign in to the platform. Available methods are:

• Single Sign-On (SSO) using Google or Microsoft work accounts. Access can be restricted to approved email domains via domain whitelisting.
• Magic Links: single-use, time-limited links sent to the user’s email address.
• Passkeys: device-bound credentials.
• Email and password, with the option for the customer to enforce two-factor authentication for all users. Two-factor authentication is performed using a one-time code generated by a third-party authenticator application. Recovery codes are provided to users at the point of setup, which can be downloaded and used to regain access if the authenticator application is unavailable.
• SAML Single Sign-On: integration with the customer’s identity provider (such as Microsoft Entra, or Google Workspace)

Yes. Our reference is ZA246797.

Hive has processes in place to support customers if their employees exercise any of their privacy rights, such as the right of access.

We provide customers with a range of options to keep their employee information up to date. These include:

• Self-service administration
• Integration with employee records systems via Kombo, so that changes in personnel are automatically updated within Hive.
• Secure file transfer of employee data files, such as via Zivver.

Hive uses one essential sub-processors outside the EU and has ensured contracts include Data Processing Agreements and encompass appropriate EU approved Standard Contractual Clauses.

This sub-processor, who is based in the USA,is responsible for the delivery of emails as part of the surveying aspect of Hive. To email individuals a unique link to a survey they process the first name and email address.

When planning to use any third parties, risk assessments are carried out to ensure there’s an adequate level of security and data protection in place, such as checking security certifications, ensuring Data Protection Agreements or EU approved Standard Contractual Clauses are in place.