Trust & security
Multi-tenant, permissioned and auditable from the first commit.
Security isn't a feature we bolted on. Isolation, role resolution and the audit trail are how the platform is built — the same gate stands in front of every click and every API call.
How one request is authorized
01
Authenticate
A person or assistant proves identity — never a superuser.
02
Resolve tenant
The request is bound to one organization only.
03
Check permission
The action is matched to the 25-key RBAC for that role.
04
Scope the data
Row-scope and field redaction applied before anything returns.
05
Write the audit
The outcome is signed and timestamped in the shared log.
Six guarantees, enforced on the server.
Tenant isolation
Every request is authorized against its own organization’s database. No cross-tenant reads, ever.
25-key RBAC
Owner, admin, member, viewer and custom roles, resolved per request. The server is the source of truth.
Full audit trail
Invites, role changes, approvals and assistant actions all leave a signed, timestamped record.
Approval chains
Configure who signs off on leave, expenses and money — routed automatically per request type.
Hardened auth
Argon2id hashing, single-use refresh tokens, rate limits and email verification as standard.
Correct by construction
Money is amount + currency in minor units with dated rates — no rounding drift, no bare floats.
Your data
You own it, and you can always leave with it.
No proprietary format and no lock-in. Everything lives in plain PostgreSQL, reachable through a documented API and one-click CSV export.
Hardened by default
Argon2id password hashing, tuned to modern hardware.
Single-use refresh tokens with rotation and reuse detection.
Rate-limited endpoints and mandatory email verification.
Money as minor units with dated FX — never a lossy float.
Bring your security team.
We'll walk the isolation model, the RBAC catalog and the audit trail end to end.