Payroll data deserves more than a filtered query
Salaries, national identifiers and bank details sit in this system. Its isolation model is enforced where it cannot be bypassed — in the database itself.
How your data is protected
Isolation in the database
Every tenant table carries an organisation identifier and is protected by row level security. Isolation does not depend on the application remembering to filter.
Server-side authorization
Permissions are checked on the server and again by the database. Hiding a button is presentation, never access control.
Role-based access
Owner, HR Administrator, Payroll Manager, HR Officer and Viewer. An HR Officer manages people without seeing salaries or bank details.
Private document storage
Employee documents, payment receipts and generated payslips live in private buckets, reachable only through short-lived signed links.
Immutable audit trail
Salary changes, payroll approval, locking and unlocking, permission changes and payment approvals are recorded and cannot be edited or deleted.
Hardened by default
Strict transport security, a content security policy, rate-limited authentication, validated uploads and no secrets in the browser bundle.
Knowing a workspace address grants nothing
Every request authenticates the user, resolves the organisation, and then verifies an active membership before anything is read. Editing the address bar to another company's workspace returns nothing — and even if a query slipped past that check, row level security would still return no rows.