{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":11410,"path":"employee-service-management/hr-service-delivery/hr-security.md","title":"HR security","bundle":null,"doc_type":null,"release":"australia","body":"\n# HR security\n\nHR Service Delivery provides Restricted Caller Access, Encryption Support, and Edge Encryption security features.\n\n**Parent Topic:**[HR Administration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/employee-service-management/hr-service-delivery/c_AdministerHRServiceManagement.md)\n\n## Restricted caller access for HR\n\nRestricted caller access \\(RCA\\) defines cross-scope access to HR Service Delivery applications.\n\nRCA is available to help secure sensitive information in HR scoped tables and script include APIs. Without RCA, tables that are not private to a scope are susceptible to queries by any server-side script.\n\nThe **Scoped Application Restricted Caller Access \\[com.glide.scope.access.restricted\\_caller\\]** plugin is activated during the HR application installation or upgrade.\n\n-   **Caller tracking**\n\n    This setting is recommended for the development stage. Access is allowed to tables and script includes, but tracked in the Restricted Caller Access table. Access information can be viewed from **Application Restricted Caller Access**.\n\n-   **Caller restriction**\n\n    This setting is recommended for the production phase after development is complete.\n\n\nTo define cross-scope access to an application resource, refer to [Define cross-scope access to an application resource](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/application-development/set-RCA-level.md).\n\n**Related topics**  \n\n\n[Set the application scope, application resources, and event access](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/application-development/scope-resource-access.md)\n\n## Encryption for HR and Employee Document Management\n\nHR Service Delivery and Employee Document Management provides encryption to secure sensitive information.\n\nEncryption prevents unauthorized users from downloading and viewing employee documents or viewing specific fields. To encrypt employee documents or fields in HR, Field Encryption is activated by default and provides role-based encryption functions.\n\nA cryptographic manager configures the fields or applications that are to be encrypted using encryption modules and module access policies:\n\n-   **Note:** Ensure the **Application** field has Employee Document Management selected.\n\n-   From the module access policy, set the role for encryption access. Specify the role to the user adding employee documents. Users with this role can access encrypted documents. See [Create a module access policy](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/create-module-access-policy.md).\n-   Employees can view their own documents when HR Service Delivery is licensed, activated, and the document type allows employee access. The role specified in the encryption module is not required for employees to view their own documents that are encrypted. [Define policies for a document type](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/employee-service-management/employee-document-management/hr-doc-management-config.md) To configure the field or attachment for encryption, see [Encrypting fields and attachments](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/field-encryption-key-management.md).\n\n**Note:** Documents that were previously encrypted using encryption contexts have the same access using encryption modules in Australia.\n\nFor details on Field Encryption see, [Field Encryption](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/field-encryption.md).\n\n## Edge Encryption for HR and Employee Document Management\n\nHR Service Delivery and Employee Document Management provides edge encryption to secure sensitive information.\n\nEdge encryption provides you with direct control over your data security. Encryption and key management are performed on your intranet between your browser and your ServiceNow instance.\n\nSee [Understanding Edge Encryption](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/c_EdgeEncryptionOverview.md).\n\nBecause edge encryption is enabled on a proxy server on your side of the network, there is significant planning, network administration and management, and setup required.\n\nSee [Planning for Edge Encryption](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/c_EdgeEncryptionPlanning.md).\n\nTo install edge encryption, see [Edge Encryption installation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/c_InstallEdgeEncryptionProxy.md).\n\nTo configure edge encryption, see [Edge Encryption configuration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-config.md).\n\n### Edge encryption for HR\n\nYou can encrypt columns \\(fields\\) or attachments associated with an HR table. See [Encrypt fields using encryption configurations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/c_ConfigureCloudEdge.md).\n\n**Note:** There are limitations when using edge encryption. See [Edge Encryption limitations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/edge-encryption-limitations.md).\n\n"}}