Security

Connections to the portal are encrypted in transit. Selected highly sensitive fields—such as tax file and bank-account numbers in supported workflows—are encrypted at the application layer. Other records rely on the encryption and access controls of the database and storage services used to operate myFORZA.

Documents are kept in private object storage and provided through authenticated or short-lived access links. Anyone who receives a valid time-limited link may be able to use it until it expires, so links must not be shared.

• Each user signs in with a personal account; credentials must not be shared.
• Role, tenant and feature permissions limit the records and actions available to each user.
• Selected payroll and credential values require additional authorised reveal workflows.
• Multi-factor or additional verification can be required for privileged accounts and sensitive actions.
• Sessions and trusted devices can be revoked when access changes or employment ends.

Privileged and security-relevant actions—including revealing selected sensitive data and downloading protected documents—may be written to audit records so access can be reviewed and investigated. Audit access is restricted; these records are not described as cryptographically immutable or tamper-proof.

Uploads are subject to file-size, type and content-signature checks. Malware scanning depends on the production security configuration and must be enabled only after its scanning service is configured. No technical control eliminates all risk, so suspicious files or unexpected access should be reported immediately.

• Choose a strong, unique password and keep verification codes private.
• Sign out on shared or public devices.
• Only access and share records for an authorised work purpose.
• Report suspicious activity, lost devices or accidental disclosure promptly.

Report a suspected security or privacy issue through the Contact page. See also the Privacy Policy and Acceptable Use Policy.