Enterprise-grade security from day one

People data is the most sensitive data you hold.

• Tenant isolation: Every record is scoped to its company at the data layer; cross-tenant access is blocked by design.
• Encryption: TLS in transit, encrypted storage at rest, and AES-256 field encryption for bank accounts and SSO secrets.
• SSO & SCIM: OIDC single sign-on (Okta and others), optional SSO-only login, and SCIM 2.0 provisioning.
• Granular RBAC: 50+ permissions, role hierarchy and time-bound delegation.
• Session security: Short-lived access tokens, rotating refresh tokens with reuse detection, and brute-force lockout.
• Audit logs: Every administrative and data change is logged with actor and timestamp.
• Data retention: Configurable retention policies with scheduled purges to support DPDP and GDPR obligations.
• Secure documents: Private storage with short-lived links; files are never publicly addressable.
• AI guardrails: Humans stay in the loop — AI drafts and suggests, people approve — and AI usage is audited.