Your people's data is handled with care.
MATANA is built for HR teams that need to move fast without compromising on trust. Here's exactly how we protect your employees' information.
Employees see only what's theirs.
Employees using the mobile app can view their own wallet, gifts, perks, events, and clubs. They cannot see other employees' personal information, wallet balances, dietary preferences, or birthday dates.
Anonymous messaging is truly anonymous in the UI. When an employee sends a message marked anonymous, their name is hidden from the HR dashboard — even though the system still stores the employee ID internally for integrity.
We don't track your employees for advertising. MATANA's built-in analytics exist solely to give HR teams aggregated usage insights. No advertising networks, analytics platforms, or data brokers receive any MATANA user data.
No passwords. Ever.
Dashboard managers sign in with their existing Google or Microsoft account. The mobile employee app works the same way — employees tap “Sign in with Google” or “Sign in with Microsoft” using their work email.
MATANA never handles your password. Identity verification is delegated entirely to Google and Microsoft, whose tokens we validate server-side using their published public keys.
On mobile: We use PKCE (Proof Key for Code Exchange) — a security standard for native apps that eliminates the need to transmit any client secret.
The right people see the right things.
Every dashboard user has a permission level — Full, Limited, or Custom — which controls exactly which sections they can access. These aren't just UI restrictions; permissions are enforced on the API server.
Your data is yours alone.
Every piece of data in MATANA — employees, gifts, events, perks, budgets — is tagged with your organization's ID. Every query is scoped to that ID, derived from your verified session token.
Built on infrastructure you can trust.
All production traffic runs over HTTPS. We do not store passwords, credit card numbers, or Social Security numbers.
| Provider | Role |
|---|---|
| Railway | Cloud hosting for the MATANA API and dashboard |
| Neon | Managed PostgreSQL — encrypted at rest, highly available |
| Google & Microsoft | OAuth identity providers — zero password storage |
| Resend | Transactional email for invitations and calendar invites |
Where we are. Where we're going.
We're honest about our current certifications and what we're working toward.
Common questions
Is MATANA SOC 2 certified?
Where is my data stored?
What happens to an employee's data when we offboard them?
Can employees see each other's information?
How do I report a security concern?
Have questions about security?
We'll walk you through exactly how MATANA protects your team's data.
security@matana-il.com · Response within 2 business days