Secure HRIS Archive Viewer
Sole builder · 2026
Turned 18 flat spreadsheet exports from a retired HRIS into one encrypted, searchable, offline profile viewer.
Impact
Replaced a decommissioned HRIS with a single self-contained file that a non-technical HR user can run offline, with cryptographic (not cosmetic) separation between general and restricted employee data.
Systems
HR areas
The problem
Our HRIS vendor shut down and left HR holding an 18-file spreadsheet export — Personal Data, Employment History, Compensation, Job History, Time Off, Immigration, Talent Notes, and more — each keyed only by employee number, with no way to look up one person and see their whole record. Some of that data (comp, SSNs, home addresses, immigration status) is materially more sensitive than the rest, and needed to stay that way even after it left the system that used to enforce access controls.
What I built
A two-file tool that needed zero infrastructure and zero IT ticket to use:
- A builder — drop in the spreadsheet exports, review an auto-classification of every column (standard vs. restricted), set two passwords, and it generates the viewer.
- A viewer — a single self-contained HTML file. Search any employee, browse a tabbed profile (Personal, Employment, Job History, Compensation, Time Off, Immigration, Talent & Performance...), with full change history on fields that changed over time.
The access model is the part I'm proudest of: the tier split is cryptographic, not a UI toggle. A "standard" password only ever derives the key for general directory-style data. The restricted half of the file — pay, SSN, home address, immigration status — is opaque ciphertext that a standard-tier session mathematically cannot decrypt, not just data that's hidden in the interface. Both files run under a strict no-network content security policy, with zero external dependencies: the ZIP/DEFLATE decoder and spreadsheet parser are hand-written because nothing could be fetched from a CDN.
Why it mattered
This wasn't a nice-to-have — it was the only way HR could still answer "what does this person's record say" after the system of record disappeared, without either leaving 18 raw spreadsheets full of SSNs sitting in a shared drive, or standing up a new hosted system (which wasn't approved, funded, or even technically permitted given data residency requirements).
My role
Owned the full build: requirements, the classification rules that sort ~200 columns into tiers, the encryption design, the renderer, and a 185-check automated test suite covering the crypto pipeline, tier-leak detection, and XSS-safety of the generated HTML.