Personal Data Protection
Last updated: 9 November 2026
Forms, workflows, and reports in AlurKerja often hold personal data: employee, customer, and applicant records, even bank account numbers. This page explains AlurKerja's role in processing that data under Indonesia's Law No. 27 of 2022 on Personal Data Protection (UU PDP), the controls already built into the platform, what is in development, and what your organization needs to prepare.
Items marked * are in development and not yet available in the platform.
This page
Personal data your organization manages inside AlurKerja.
Privacy Policy →
Your data as a user and visitor of alurkerja.com.
Security →
Hosting, encryption, backups, and infrastructure certification.
1. Roles: Controller and Processor
The PDP Law separates the party that decides why data is processed from the party that processes it on that party's instructions.
- Your organization is the Personal Data Controller for data entered into the forms, workflows, documents, and reports in your workspace. Your organization decides what data is collected, for what purpose, and for how long.
- AlurKerja (PT Javan Cipta Solusi) is the Personal Data Processor for that data. We process it only to run the service under our agreement and your instructions, and do not use it for any other purpose.
- For user account, billing, and website visit data, AlurKerja is the controller. See the Privacy Policy for details.
2. PDP Controls Built Into the Platform
The PDP Law requires technical measures that keep personal data secure and confidential and prevent unauthorized access (Articles 35, 36, and 39). We apply this privacy by design principle in AlurKerja's service code, not only on paper:
Isolated database schema per organization
- Each organization's custom tables and report data live in a database schema of their own, separate from every other organization.
- Report queries written by users are locked to their organization's schema in two layers: a query checker rejects other schema names and functions that could change the search path, and the executing connection is pointed at that organization's schema only.
- The organization behind each request is set by the server from a verified session, never from a value sent by the client.
Encrypted integration credentials
- Integration credentials (SMTP passwords, tokens, third-party API keys) are stored encrypted with AES-256-GCM and a random nonce per value.
- The encryption key is kept outside the database. The service refuses to start when the key is missing or invalid, so it never silently falls back to a built-in key.
- The key can be rotated: every credential is decrypted with the old key and re-encrypted with the new one.
Masking sensitive data on screen
- Password and OTP fields are masked in activity history and revealed only on a user's action.
- Bank account fields show only the last 4 digits; the full number is still stored for payments.
- API keys and bot tokens are write-only: once saved, the screen shows a masked hint, never the actual value.
Data minimization in logs
- Integration configuration is not stored in execution history. Secret values that appear in script output or API responses are redacted before they are stored or displayed.
- The API gateway activity log keeps only headers from an allowlist. Access tokens are read to record who made a request, but are never stored.
- Error reports sent to the monitoring system are filtered first: credential headers and download tokens are replaced with a
[redacted]marker.
Audit trail
- Backup exports and restores are recorded in an append-only audit log: who, when, and which resources.
- Changes to an organization's custom table structure are recorded with the actor, time, and outcome.
Limited retention
- Completed integration queue data is deleted automatically after its retention period (30 days by default).
- Download links for export files are signed and stop working once they expire.
Data location
- By default, data is stored in Contabo data centers in Germany and Singapore. Enterprise clients can choose a Private Cloud in Indonesia or On-Premise. Infrastructure safeguards are described on the Security page.
3. In Development
We are building the following features so PDP Law obligations are easier to meet directly in AlurKerja:
Personal data field classification
A marker on form fields for general and specific personal data (Article 4), such as national ID numbers, health, or biometric data, that turns on masking and access restrictions automatically.
Role-based masking
National ID and tax numbers, phone numbers, and email addresses appear masked except to roles allowed to see the full value.
Field-level encryption
Values of fields marked as specific personal data are stored encrypted in the database, not only masked on screen.
Consent component for forms
Records a data subject's consent with the text version, time, and proof (Article 22), plus a flow to withdraw consent.
Per-process retention policy
Process instance data is deleted or anonymized automatically after a retention period set by your organization.
Data subject request template
A ready-to-use workflow for access, correction, erasure, and copy requests, with a 3 x 24 hour deadline reminder (Article 32).
Per-subject data export
Gathers all of one subject's data across processes into a machine-readable format for the right to portability.
Read-access log for personal data
Records who opened a record containing personal data, not only who changed it.
Automatic record of processing activities
A list of the processes that collect personal data and the data types they collect, built from the process catalog (Article 31).
Impact assessment (DPIA) template
Impact assessment guidance for high-risk processes (Article 34) that can be attached to a process definition.
Personal data redaction for AI services
Fields marked as personal data are masked before they are sent to AI and simulation features.
Data breach notification workflow
An incident template with a 3 x 24 hour countdown for notifying data subjects and the authority (Article 46).
Deletion certificate on offboarding
Deletes all of an organization's data when the contract ends, with proof of deletion.
Indonesia region for standard cloud plans
An Indonesian data location without requiring an Enterprise plan, reducing the need for cross-border transfers (Article 56).
Items marked * are in development and not yet available in the platform.
4. Data Subject Rights
The PDP Law gives data subjects the right to access, correct, and erase their data, withdraw consent, and obtain a copy. For data in your workspace:
- Data subject requests are addressed to your organization as the controller.
- Organization admins can find, correct, export, and delete data through the relevant AlurKerja modules.
- If a request reaches AlurKerja, we forward it to your organization and help carry it out.
5. Data Protection Failures
The PDP Law requires the controller to report a personal data protection failure within 3 x 24 hours (Article 46). If we detect an incident involving data in your workspace, we promptly notify your organization's contact with the information you need to meet that obligation: the affected data, when it happened, and the response steps.
6. What Your Organization Should Prepare
- Collect only what you need. Design forms with only the fields the process actually requires.
- Pick the right field types. Use the password, OTP, or bank account types for sensitive data so masking applies automatically.
- Limit access. Set roles and permissions so personal data is visible only to users who need it.
- Set a lawful basis. Make sure every process that collects personal data has a lawful basis, such as consent or performance of a contract.
- Decide how long to keep it. Delete or archive data that is no longer needed.
7. Contact
Questions or requests about personal data: [email protected]
Vulnerability or security incident reports: [email protected]
Personal Data Protection FAQ
Who is the controller of the personal data I store in AlurKerja?
Your organization. Employee, customer, or applicant data you process through AlurKerja forms and workflows is controlled by your organization as the Personal Data Controller. AlurKerja (PT Javan Cipta Solusi) acts as the Personal Data Processor, processing that data on your instructions.
How is this page different from the Privacy Policy?
The Privacy Policy covers your personal data as a user and visitor of alurkerja.com, where AlurKerja is the controller. This page covers how AlurKerja protects the personal data your organization manages inside the platform, and how the platform helps your organization comply with the PDP Law.
Is my organization's data separated from other organizations?
Yes. Each organization's custom tables and report data sit in a database schema of their own, and report queries are locked to the owning organization's schema, so they cannot read another organization's data.
Can personal data be stored in Indonesia?
Yes. Enterprise clients can choose a Private Cloud deployment in an Indonesian data center or On-Premise on their own servers, so data never leaves Indonesian jurisdiction.
What if a data subject asks for their data to be deleted?
Data subject requests are addressed to your organization as the controller. Organization admins can find, correct, export, and delete data in the relevant modules. If such a request reaches AlurKerja, we forward it to your organization and help carry it out.
Need documents for a compliance review?
Our enterprise team can help with PDP questionnaires, security briefings, and data processing agreements for your procurement.
Contact the Enterprise Team