How Lemmpo protects your data

In transit. All traffic between workstations, mobile apps and the Lemmpo infrastructure is encrypted, with certificates renewed automatically.

Passwords. They are never stored in clear text or in any reversible form. They are hashed using a recognized key derivation function, with a distinct random salt per account. Even if the database were compromised, the passwords would not be usable as they stand.

Files and attachments. No user file is written to a server file system. Job photos, reports and documents are held in a perimeter attached to your organization and reachable only by authorized users. There is no file accessible through a guessable URL.

Isolation. Separation is applied at two levels: between customer organizations first, then inside your organization by team, project, site or role. An employee only sees the perimeter assigned to them.

Your data is hosted in the European Union, with OVHcloud. No operational data leaves that perimeter.

Why this matters if you operate in Europe. Employee scheduling and time-tracking data is personal data under the GDPR. Keeping it inside the EU means your processing sits inside the regulatory perimeter by default, rather than depending on a transfer mechanism you have to document and defend. If your legal team has ever had to fill in a transfer impact assessment, they will recognize what that saves.

If you operate only in North America, this is simply a neutral fact: your data is held in a jurisdiction with strong statutory data-protection guarantees, by a vendor whose revenue comes from subscriptions rather than from data. We do not sell your data, and we do not use it to train third-party models.

Stricter requirements. If your situation calls for a dedicated hosting arrangement — a customer imposing a specific standard, an internal security requirement — that can be discussed under the Enterprise plan, after assessment and quote. Tell us at the first conversation and we will tell you plainly whether we can meet it, rather than costing you a procurement cycle.

Like any online software vendor, Lemmpo relies on a limited number of third-party services. We keep that list current and share it in full — role, location and status of each — with your security or compliance team.

The principle we apply: operational data — schedules, hours, time off, projects, field reports and your employees' information — stays within the EU. It is not passed to any third-party service.

The few services located outside the European Union sit at the edge of the product: subscription payment processing, company-directory enrichment from domain names, and push notification delivery to phones — the last of which is inherent to mobile operating systems and cannot be avoided by any iOS or Android application.

This page covers principles. The detail — a pre-completed security questionnaire, architecture diagram, quantified recovery objectives, the full subprocessor register, material for your vendor assessment — is shared on request, with a named contact.

Running a security review or a vendor assessment? Write to us with your context: we will send our security questionnaire, or complete your own template directly.