Quick HR Solutions, LLC
Product: CypressHR (HR software for businesses)
Contact: support@cypresshr.app
Last updated: October 18, 2026
We host employment documents on purpose, including a Medical / ADA vault for medical files, and we take that seriously with controls at launch. We answer security questionnaires honestly with current facts.
Who we are (security-relevant)
- United States HR software: the Service alone, or the Service plus fractional HR consulting
- United States only for now
- Not a PEO. Customer is employer of record
- Processor / service provider for Customer Employee Data
- Month-to-month SaaS in which each customer’s data is kept separate from every other customer’s
- Medical / ADA vault for medical employment documents, kept apart from the main personnel file
Controls at launch
| Control | What we do |
|---|---|
| Encryption in transit | TLS for data moving over public networks |
| Encryption at rest | Primary datastores and file/object storage encrypted at rest |
| MFA | Multi-factor authentication available for account security |
| Each customer’s data is kept separate from every other customer’s | Application-level separation so Customer A cannot access Customer B’s data by design |
| Backups | Regular encrypted backups through our database provider, with point-in-time restore. |
| Audit logging | Logging of security-relevant and administrative actions |
| Least privilege | Role-based access in-product; employee-relations notes are limited to the Customer's owner and HR roles; Quick HR staff access on need-to-know for support/security only |
| Incident response | Internal breach plan that follows Texas data-breach law (Bus. & Com. Code ch. 521); Customer notice without unreasonable delay |
Main hosting in the United States (Vercel, Neon, Vercel Blob). Full vendor list and locations on the Subprocessors page.
Medical / ADA vault
Medical certifications, doctor notes, and related ADA medical paperwork belong in the Medical / ADA vault, kept apart from the main personnel file. Ordinary HR documents stay in general files. Non-medical operational ADA notes (no medical content) may remain in restricted general HR files.
We describe this as a product capability and talk about the controls and agreement that are actually in place. Ask us what is live today if you are filling out a security questionnaire.
How we talk about security
- Controls at launch: encryption, MFA, keeping each customer’s data separate from every other customer’s, backups, and audit logs. Main hosting in the United States (Vercel, Neon, Vercel Blob). Full vendor list and locations on the Subprocessors page.
- Medical / ADA paperwork uses the separate Medical vault
- We do not sell Customer Employee Data or use it to train public AI models
- Using CypressHR does not by itself make your company legally compliant. You remain the employer.
Customer shared responsibility
| Quick HR | Customer |
|---|---|
| Service security, keeping each customer’s data separate from every other customer’s, encryption, backups, logging | Employer policies, lawful use, worker notices |
| MFA features and admin tooling | Turning MFA on, managing roles, offboarding users promptly |
| Breach notice to Customer per agreement / Texas data-breach law (Bus. & Com. Code ch. 521): because we hold your data for you, we must tell you promptly about a breach. | Individual notices when Customer owns/licenses sensitive personal information (SPI); employment decisions |
| Export tools / deletion after termination | Exporting records Customer must retain under employment law |
| Medical vault for medical employment docs | Putting medical files in the vault; configuring access |
Security questionnaires welcome
Send questionnaires to support@cypresshr.app. We respond with current facts and mark unknowns clearly.