Your data, kept apart and accounted for.

Isolation

• Every table carries the organization, and the data layer refuses any query that isn’t scoped to the caller’s organization.
• Each organization has its own Google Identity Platform tenant, so sign-in, SSO configuration and user pools never mix.
• Files are stored under the organization’s own path in Cloud Storage, and security rules check the organization claim on every read.

Access

• Single sign-on with Microsoft Entra ID (SAML or OIDC) or any standards-based identity provider; multi-factor authentication is enforced by your provider.
• Roles map to how you license and think about users — core finance, core HR and payroll, departmental, approver, inquiry, self-service — and can be customized down to the permission.
• Department scope limits users to their own business units in lists, reports and dashboards.
• Sensitive fields — Social Security numbers, bank accounts, birth dates — are masked unless the user holds a specific permission, and every reveal is logged.
• Segregation-of-duties rules flag users who hold conflicting permissions, and approvals block anyone from approving their own request.

Audit trail

• Every create, change, approval, export and reveal is written to an append-only audit log with who, when, from where and what changed.
• The log is sealed daily with a hash chain so tampering is detectable.
• Retention policies and legal holds are configurable by record type.

Infrastructure

• Runs on Google Cloud (Firebase Hosting, Cloud Functions, Cloud SQL for PostgreSQL through Data Connect, Firestore) in US regions.
• Encryption in transit (TLS 1.2+) and at rest; secrets are held in Secret Manager, never in code or configuration files.
• Separate development, staging and production projects; every change is deployed from the repository, not by hand.
• Accessibility to WCAG 2.2 AA is a release requirement, not an afterthought.

We’re glad to complete your security questionnaire (HECVAT, SIG Lite or your own) as part of an evaluation.