What it does

AES-256-GCM encrypted storage for sensitive data (government IDs, etc.) — never stored as plain text anywhere else in the system.

How to use it

1. Sensitive fields (SSS/PhilHealth/Pag-IBIG/TIN numbers, and similar) are automatically routed through the vault whenever they're saved — from HR's employee-edit page or an employee's own My Profile.
2. Only roles explicitly granted vault access can ever view the decrypted value; everyone else sees it masked.
3. Every view of a decrypted value is logged for audit.