[{"data":1,"prerenderedAt":638},["ShallowReactive",2],{"navigation":3,"\u002Fsecurity\u002Foverview":395,"\u002Fsecurity\u002Foverview-surround":633},[4,23,53,78,107,142,166,202,238,277,306,361],{"title":5,"path":6,"stem":7,"children":8,"icon":22},"Getting Started","\u002Fgetting-started","1.getting-started\u002F1.index",[9,12,17],{"title":10,"path":6,"stem":7,"icon":11},"Introduction","i-lucide-house",{"title":13,"path":14,"stem":15,"icon":16},"Usage","\u002Fgetting-started\u002Fusage","1.getting-started\u002F3.usage","i-lucide-sliders",{"title":18,"path":19,"stem":20,"icon":21},"Signing in on the mobile app","\u002Fgetting-started\u002Fmobile-app-sign-in","1.getting-started\u002F4.mobile-app-sign-in","i-lucide-smartphone",false,{"title":24,"icon":22,"path":25,"stem":26,"children":27,"page":22},"Billing & Plans","\u002Fbilling","10.billing",[28,33,38,43,48],{"title":29,"path":30,"stem":31,"icon":32},"Plans","\u002Fbilling\u002Fplans","10.billing\u002F1.plans","i-lucide-credit-card",{"title":34,"path":35,"stem":36,"icon":37},"Limits & Usage","\u002Fbilling\u002Flimits-and-usage","10.billing\u002F2.limits-and-usage","i-lucide-gauge",{"title":39,"path":40,"stem":41,"icon":42},"Managing Your Subscription","\u002Fbilling\u002Fmanaging-your-subscription","10.billing\u002F3.managing-your-subscription","i-lucide-receipt",{"title":44,"path":45,"stem":46,"icon":47},"Add-ons","\u002Fbilling\u002Fadd-ons","10.billing\u002F4.add-ons","i-lucide-puzzle",{"title":49,"path":50,"stem":51,"icon":52},"Integrations","\u002Fbilling\u002Fintegrations","10.billing\u002F5.integrations","i-lucide-plug",{"title":54,"icon":22,"path":55,"stem":56,"children":57,"page":22},"Settings","\u002Fsettings","11.settings",[58,62,66,70,74],{"title":59,"path":60,"stem":61},"General","\u002Fsettings\u002Fgeneral","11.settings\u002F1.general",{"title":63,"path":64,"stem":65},"Leave Types","\u002Fsettings\u002Fleavetype","11.settings\u002F2.leaveType",{"title":67,"path":68,"stem":69},"Carry Forward","\u002Fsettings\u002Fcarryforward","11.settings\u002F3.carryForward",{"title":71,"path":72,"stem":73},"Department Management","\u002Fsettings\u002Fdepartments","11.settings\u002F4.departments",{"title":75,"path":76,"stem":77},"Public Holidays","\u002Fsettings\u002Fpublicholiday","11.settings\u002F5.publicholiday",{"title":79,"path":80,"stem":81,"children":82,"page":22},"Mcp","\u002Fmcp","12.mcp",[83,88,92,97,102],{"title":84,"path":85,"stem":86,"icon":87},"Overview","\u002Fmcp\u002Foverview","12.mcp\u002F1.overview","i-lucide-bot",{"title":89,"path":90,"stem":91,"icon":52},"Connecting","\u002Fmcp\u002Fconnecting","12.mcp\u002F2.connecting",{"title":93,"path":94,"stem":95,"icon":96},"Tools Reference","\u002Fmcp\u002Ftools","12.mcp\u002F3.tools","i-lucide-wrench",{"title":98,"path":99,"stem":100,"icon":101},"Security","\u002Fmcp\u002Fsecurity","12.mcp\u002F4.security","i-lucide-shield",{"title":103,"path":104,"stem":105,"icon":106},"Integrating Your Own MCP Client","\u002Fmcp\u002Fcustom-client","12.mcp\u002F5.custom-client","i-lucide-code",{"title":108,"icon":22,"path":109,"stem":110,"children":111,"page":22},"Leave Management","\u002Fleave-management","2.leave-management",[112,117,122,127,132,137],{"title":113,"path":114,"stem":115,"icon":116},"Leave Management Overview","\u002Fleave-management\u002Foverview","2.leave-management\u002F1.overview","i-lucide-palmtree",{"title":118,"path":119,"stem":120,"icon":121},"Requesting Leave","\u002Fleave-management\u002Frequesting-leave","2.leave-management\u002F2.requesting-leave","i-lucide-calendar-plus",{"title":123,"path":124,"stem":125,"icon":126},"Leave Balances","\u002Fleave-management\u002Fleave-balances","2.leave-management\u002F3.leave-balances","i-lucide-wallet",{"title":128,"path":129,"stem":130,"icon":131},"Group Booking","\u002Fleave-management\u002Fgroup-booking","2.leave-management\u002F4.group-booking","i-lucide-users",{"title":133,"path":134,"stem":135,"icon":136},"Editing and Cancelling Leave","\u002Fleave-management\u002Fediting-and-cancelling","2.leave-management\u002F5.editing-and-cancelling","i-lucide-pencil",{"title":138,"path":139,"stem":140,"icon":141},"Leave Troubleshooting","\u002Fleave-management\u002Ftroubleshooting","2.leave-management\u002F6.troubleshooting","i-lucide-life-buoy",{"title":143,"icon":22,"path":144,"stem":145,"children":146,"page":22},"Approvals","\u002Fapprovals","3.approvals",[147,152,157,161],{"title":148,"path":149,"stem":150,"icon":151},"Approvals Overview","\u002Fapprovals\u002Foverview","3.approvals\u002F1.overview","i-lucide-check-check",{"title":153,"path":154,"stem":155,"icon":156},"Leave Approvals","\u002Fapprovals\u002Fleave-approvals","3.approvals\u002F2.leave-approvals","i-lucide-calendar-check",{"title":158,"path":159,"stem":160,"icon":42},"Expense Approvals","\u002Fapprovals\u002Fexpense-approvals","3.approvals\u002F3.expense-approvals",{"title":162,"path":163,"stem":164,"icon":165},"Time Approvals","\u002Fapprovals\u002Ftime-approvals","3.approvals\u002F4.time-approvals","i-lucide-clock-9",{"title":167,"icon":22,"path":168,"stem":169,"children":170,"page":22},"Time tracking & monitoring","\u002Ftime-tracking","4.Time Tracking",[171,176,181,186,190,194,198],{"title":172,"path":173,"stem":174,"icon":175},"Clocking In & Location","\u002Ftime-tracking\u002Fclock-in-and-location","4.Time Tracking\u002F5.clock-in-and-location","i-lucide-map-pin",{"title":177,"path":178,"stem":179,"icon":180},"Overtime & Pay-Period Lockdown","\u002Ftime-tracking\u002Fovertime-and-lockdown","4.Time Tracking\u002F6.overtime-and-lockdown","i-lucide-lock",{"title":182,"path":183,"stem":184,"icon":185},"Geofencing","\u002Ftime-tracking\u002Fgeofencing","4.Time Tracking\u002F7.geofencing","i-lucide-map",{"title":187,"path":188,"stem":189},"Time & Projects","\u002Ftime-tracking\u002Ftimeandprojects","4.Time Tracking\u002FTime&Projects",{"title":191,"path":192,"stem":193},"Time Tracking","\u002Ftime-tracking\u002Ftime-tracking","4.Time Tracking\u002FTime-tracking",{"title":195,"path":196,"stem":197},"Timeboard","\u002Ftime-tracking\u002Ftimeboard","4.Time Tracking\u002FTimeBoard",{"title":199,"path":200,"stem":201},"Timesheets","\u002Ftime-tracking\u002Ftimesheets","4.Time Tracking\u002FTimesheets",{"title":203,"icon":22,"path":204,"stem":205,"children":206,"page":22},"Expenses","\u002Fexpenses","5.expenses",[207,211,215,219,223,228,233],{"title":208,"path":209,"stem":210},"Expense Claims","\u002Fexpenses\u002Foverview","5.expenses\u002F1.overview",{"title":212,"path":213,"stem":214},"Add & Manage Purchases","\u002Fexpenses\u002Fpurchases","5.expenses\u002F2.purchases",{"title":216,"path":217,"stem":218},"Travel & Mileage Entry","\u002Fexpenses\u002Ftravelentries","5.expenses\u002F3.travelentries",{"title":220,"path":221,"stem":222,"icon":32},"Company Card Expenses","\u002Fexpenses\u002Fcompany-cards","5.expenses\u002F4.company-cards",{"title":224,"path":225,"stem":226,"icon":227},"Per Diems","\u002Fexpenses\u002Fper-diems","5.expenses\u002F5.per-diems","i-lucide-utensils",{"title":229,"path":230,"stem":231,"icon":232},"Receipt Scanning","\u002Fexpenses\u002Freceipt-scanning","5.expenses\u002F6.receipt-scanning","i-lucide-scan-line",{"title":234,"path":235,"stem":236,"icon":237},"Statuses & Submission","\u002Fexpenses\u002Fstatuses-and-submission","5.expenses\u002F7.statuses-and-submission","i-lucide-git-pull-request-arrow",{"title":239,"icon":22,"path":240,"stem":241,"children":242,"page":22},"Documents & E-Signatures","\u002Fdocuments","6.documents",[243,247,252,257,262,267,272],{"title":84,"path":244,"stem":245,"icon":246},"\u002Fdocuments\u002Foverview","6.documents\u002F1.overview","i-lucide-folder-open",{"title":248,"path":249,"stem":250,"icon":251},"Uploading Documents","\u002Fdocuments\u002Fuploading","6.documents\u002F2.uploading","i-lucide-upload",{"title":253,"path":254,"stem":255,"icon":256},"E-Signatures","\u002Fdocuments\u002Fe-signatures","6.documents\u002F3.e-signatures","i-lucide-pen-tool",{"title":258,"path":259,"stem":260,"icon":261},"Audit Trail & Certificate","\u002Fdocuments\u002Faudit-trail","6.documents\u002F4.audit-trail","i-lucide-file-check",{"title":263,"path":264,"stem":265,"icon":266},"Templates & Bulk Send","\u002Fdocuments\u002Ftemplates-and-bulk-send","6.documents\u002F5.templates-and-bulk-send","i-lucide-layout-template",{"title":268,"path":269,"stem":270,"icon":271},"Onboarding","\u002Fdocuments\u002Fonboarding","6.documents\u002F6.onboarding","i-lucide-user-plus",{"title":273,"path":274,"stem":275,"icon":276},"Offboarding","\u002Fdocuments\u002Foffboarding","6.documents\u002F7.offboarding","i-lucide-user-minus",{"title":278,"icon":22,"path":279,"stem":280,"children":281,"page":22},"People & HR","\u002Fpeople","7.people",[282,286,291,296,301],{"title":283,"path":284,"stem":285,"icon":131},"Directory & Profiles","\u002Fpeople\u002Fdirectory-and-profiles","7.people\u002F1.directory-and-profiles",{"title":287,"path":288,"stem":289,"icon":290},"Managing Users","\u002Fpeople\u002Fmanaging-users","7.people\u002F2.managing-users","i-lucide-user-cog",{"title":292,"path":293,"stem":294,"icon":295},"HR Records","\u002Fpeople\u002Fhr-records","7.people\u002F3.hr-records","i-lucide-folder-archive",{"title":297,"path":298,"stem":299,"icon":300},"Performance","\u002Fpeople\u002Fperformance","7.people\u002F4.performance","i-lucide-target",{"title":302,"path":303,"stem":304,"icon":305},"Training","\u002Fpeople\u002Ftraining","7.people\u002F5.training","i-lucide-graduation-cap",{"title":307,"icon":22,"path":308,"stem":309,"children":310,"page":22},"Features","\u002Ffeatures","8.features",[311,315,319,324,329,333,337,341,345,349,353,357],{"title":312,"path":313,"stem":314},"Dashboard","\u002Ffeatures\u002Fdashboard","8.features\u002F1.dashboard",{"title":316,"path":317,"stem":318},"SMTP troubleshoot","\u002Ffeatures\u002Fsmtp-troubleshoot","8.features\u002F10.smtp-troubleshoot",{"title":320,"path":321,"stem":322,"icon":323},"Notifications","\u002Ffeatures\u002Fnotifications","8.features\u002F11.notifications","i-lucide-bell",{"title":325,"path":326,"stem":327,"icon":328},"Reports","\u002Ffeatures\u002Freports","8.features\u002F12.reports","i-lucide-bar-chart-3",{"title":330,"path":331,"stem":332},"Calendar & Leave Overview","\u002Ffeatures\u002Fcalendar","8.features\u002F2.calendar",{"title":334,"path":335,"stem":336},"Calendar Integration","\u002Ffeatures\u002Fcalendar-integration","8.features\u002F3.calendar-integration",{"title":338,"path":339,"stem":340},"Schedules","\u002Ffeatures\u002Fschedules","8.features\u002F4.schedules",{"title":342,"path":343,"stem":344},"Project Management","\u002Ffeatures\u002Fprojects","8.features\u002F5.projects",{"title":346,"path":347,"stem":348},"Expense Settings","\u002Ffeatures\u002Fexpense-settings","8.features\u002F6.expense-settings",{"title":350,"path":351,"stem":352},"Auth0 SSO Integration","\u002Ffeatures\u002Fauth0-integration","8.features\u002F7.auth0-integration",{"title":354,"path":355,"stem":356},"Password & Authentication Policy","\u002Ffeatures\u002Fpolicies","8.features\u002F8.policies",{"title":358,"path":359,"stem":360},"Email Configuration (SMTP)","\u002Ffeatures\u002Femail-configuration","8.features\u002F9.email-configuration",{"title":362,"icon":22,"path":363,"stem":364,"children":365,"page":22},"Security & Privacy","\u002Fsecurity","9.security",[366,371,376,380,385,390],{"title":367,"path":368,"stem":369,"icon":370},"Security Overview","\u002Fsecurity\u002Foverview","9.security\u002F1.overview","i-lucide-shield-check",{"title":372,"path":373,"stem":374,"icon":375},"Authentication","\u002Fsecurity\u002Fauthentication","9.security\u002F2.authentication","i-lucide-log-in",{"title":377,"path":378,"stem":379,"icon":21},"Two-Factor & Devices","\u002Fsecurity\u002Ftwo-factor-and-devices","9.security\u002F3.two-factor-and-devices",{"title":381,"path":382,"stem":383,"icon":384},"Audit & Monitoring","\u002Fsecurity\u002Faudit-and-monitoring","9.security\u002F4.audit-and-monitoring","i-lucide-scroll-text",{"title":386,"path":387,"stem":388,"icon":389},"Account Deletion & Privacy","\u002Fsecurity\u002Faccount-deletion-and-privacy","9.security\u002F5.account-deletion-and-privacy","i-lucide-user-x",{"title":391,"path":392,"stem":393,"icon":394},"Roles & Permissions","\u002Fsecurity\u002Froles-and-permissions","9.security\u002F6.roles-and-permissions","i-lucide-key-round",{"id":396,"title":367,"body":397,"description":626,"extension":627,"links":628,"meta":629,"navigation":630,"path":368,"seo":631,"stem":369,"__hash__":632},"docs\u002F9.security\u002F1.overview.md",{"type":398,"value":399,"toc":611},"minimark",[400,404,408,413,416,428,431,446,455,459,466,473,477,484,488,500,504,521,525,532,550,556,560,577,583,587,590,594,605],[401,402,367],"h1",{"id":403},"security-overview",[405,406,407],"p",{},"BookYourPTO is built for organizations that hold sensitive people data — leave records, compensation, identity documents, and time logs. This page is the security model at a glance, so admins and security reviewers can see how the pieces fit together. Each topic links to a dedicated page with the full detail.",[409,410,412],"h2",{"id":411},"layered-request-protection","Layered request protection",[405,414,415],{},"Every API request passes through layered security checks before it reaches a handler — resolving the organization context, validating the caller's session, confirming the account is active and in good standing, enforcing the org's plan entitlements, and recording the request for monitoring.",[417,418,421],"callout",{"color":419,"icon":420},"blue","i-lucide-info",[405,422,423,427],{},[424,425,426],"strong",{},"Why re-check on every request?"," The account is re-validated on each call, so a deactivated user stops working promptly — even mid-session — without waiting for their session to expire.",[409,429,372],{"id":430},"authentication",[405,432,433,434,437,438,441,442,445],{},"Login uses short-lived ",[424,435,436],{},"JWT access tokens"," paired with longer-lived ",[424,439,440],{},"refresh tokens"," stored in the database. Every refresh ",[424,443,444],{},"rotates both tokens atomically"," — the old pair is deleted and a new one issued — so a stolen refresh token is useful only until the legitimate client refreshes next. Reuse of a rotated token is treated as theft.",[405,447,448,449,454],{},"See ",[424,450,451],{},[452,453,372],"a",{"href":373}," for the login flow, token rotation, password policy, force-password-change, and forgot\u002Freset.",[409,456,458],{"id":457},"two-factor-authentication-trusted-devices","Two-factor authentication & trusted devices",[405,460,461,462,465],{},"Optional (or org-mandated) ",[424,463,464],{},"TOTP"," two-factor with one-time backup codes. Devices can be trusted to skip the 2FA prompt for a limited time, and every trusted device can be listed and revoked.",[405,467,448,468,472],{},[424,469,470],{},[452,471,377],{"href":378},".",[409,474,476],{"id":475},"encryption-at-rest","Encryption at rest",[405,478,479,480,483],{},"Personally identifiable information is encrypted in the database with ",[424,481,482],{},"AES-256-GCM"," field encryption, while still supporting fast lookups without decrypting every row.",[409,485,487],{"id":486},"rate-limiting","Rate limiting",[405,489,490,491,494,495,499],{},"Auth-sensitive endpoints — login, two-factor verification, password reset, deletion-code requests, and data exports — are subject to strict rate limits to blunt brute-force and abuse. When a limit is hit, responses return ",[424,492,493],{},"HTTP 429"," with a ",[496,497,498],"code",{},"retryAfter"," value telling the client how long to wait.",[409,501,503],{"id":502},"security-headers","Security headers",[405,505,506,507,510,511,510,514,517,518,472],{},"In production, responses carry hardened headers: ",[424,508,509],{},"HSTS",", ",[496,512,513],{},"X-Content-Type-Options: nosniff",[496,515,516],{},"X-Frame-Options: SAMEORIGIN",", a strict referrer policy, a restrictive permissions policy, and a ",[424,519,520],{},"Content-Security-Policy",[409,522,524],{"id":523},"audit-logging-monitoring","Audit logging & monitoring",[405,526,527,528,531],{},"Every meaningful action is recorded with a full before\u002Fafter change record, the actor, IP, user agent, and timestamp. Sign-in attempts (success and failure) are tracked separately, and an ",[424,529,530],{},"unknown-login email alert"," fires on logins from new locations.",[417,533,536],{"color":534,"icon":535},"green","i-lucide-sparkles",[405,537,538,541,542,545,546,472],{},[424,539,540],{},"Now on every plan."," Audit logs are available on ",[424,543,544],{},"every plan, including Free"," (previously Business-only). See ",[424,547,548],{},[452,549,29],{"href":30},[405,551,448,552,472],{},[424,553,554],{},[452,555,381],{"href":382},[409,557,559],{"id":558},"account-deletion-privacy","Account deletion & privacy",[405,561,562,563,510,566,510,569,572,573,576],{},"In-app, GDPR\u002FCCPA-compliant ",[424,564,565],{},"account deletion",[424,567,568],{},"organization deletion",[424,570,571],{},"data export",", and ",[424,574,575],{},"CCPA opt-out"," — each confirmed where required by an emailed 6-digit code.",[405,578,448,579,472],{},[424,580,581],{},[452,582,386],{"href":387},[409,584,586],{"id":585},"demo-instance-lockdown","Demo-instance lockdown",[405,588,589],{},"The public demo runs in a locked-down mode that blocks destructive writes, so anyone can explore it without affecting other visitors.",[409,591,593],{"id":592},"roles","Roles",[405,595,596,597,600,601,604],{},"Access is scoped by four roles — ",[424,598,599],{},"Employee, Department Head, Administrator, Executive"," — plus a per-user ",[424,602,603],{},"isApprover"," flag and department scoping. All client-side permission checks are mirrored and enforced on the server; the backend is always authoritative.",[405,606,448,607,472],{},[424,608,609],{},[452,610,391],{"href":392},{"title":612,"searchDepth":613,"depth":614,"links":615},"",1,2,[616,617,618,619,620,621,622,623,624,625],{"id":411,"depth":614,"text":412},{"id":430,"depth":614,"text":372},{"id":457,"depth":614,"text":458},{"id":475,"depth":614,"text":476},{"id":486,"depth":614,"text":487},{"id":502,"depth":614,"text":503},{"id":523,"depth":614,"text":524},{"id":558,"depth":614,"text":559},{"id":585,"depth":614,"text":586},{"id":592,"depth":614,"text":593},"How BookYourPTO protects your account and your organization's data — authentication, encryption, rate limiting, security headers, audit logging, and account guards.","md",null,{},{"icon":370},{"title":367,"description":626},"S0bZizykLdzMimToIrSM8QW6QjzpATBRqgX7zNV-ELI",[634,636],{"title":358,"path":359,"stem":360,"description":635,"children":-1},"Learn how to configure SMTP settings to enable system emails such as notifications, alerts, and user communications.",{"title":372,"path":373,"stem":374,"description":637,"icon":375,"children":-1},"How sign-in works in BookYourPTO — login, JWT access and refresh tokens with rotation, force-password-change, the password policy, forgot\u002Freset, and email verification.",1781157134270]