Security

Employee data is sensitive. Here is how the platform is built to keep it controlled and protected.

Role-based access control

Every user works under a defined role. Employees see their own records, managers see their teams, and HR administrators manage their organization. Access follows the role, not the URL.

Secure authentication

Passwords are hashed — never stored or transmitted in plain text. Sessions run on signed tokens, and every API request is verified against the authenticated user and their organization.

Organization data isolation

Each organization's employees, payroll and records are separate. Queries are scoped to the signed-in user's organization, so one company's data is never exposed to another.

Questions or concerns

If you have a security question about the platform or your data, write to us and we will respond directly.