We are precise about what's actually in place. No inflated claims about features that don't exist — just a clear explanation of how your data stays isolated, private, and audit-ready.
Four core controls that are enforced at the platform level — not optional, not configuration-dependent.
Every query to every model in the application runs through a global company scope. It is not possible for Company A's HR admin to retrieve Company B's data — the WHERE clause is added at the ORM layer before the query reaches the database, not in the controller or UI. This is enforced via Laravel global scopes on all tenant-scoped models.
Three distinct access layers exist: the platform admin (manages all companies, on a separate guard with its own session), the company admin/HR admin (manages their own company's data only), and employees (access only their own training/attendance records via token-gated links). Each layer is completely separate — no user can escalate across layers.
Every background verification review decision, every platform admin action (company activation, plan change), and every sensitive admin operation generates a timestamped audit log entry with the actor's ID and action detail. These logs are append-only at the application layer and readable by the platform admin for cross-tenant compliance visibility.
All uploaded files (BGV documents, employee certificates, company logos, offer letters) are stored on a private storage disk. Documents are served only via signed, time-limited URLs to authenticated sessions — there are no publicly guessable URLs that expose raw uploads. Aadhaar and PAN numbers are additionally masked at the rendering layer wherever they would otherwise appear.
Company accounts can only be created after verifying a real email address via a one-time password. There is no direct POST endpoint that creates accounts without an OTP round-trip — this prevents someone from signing up with an email address they don't own and impersonating another organization.
Employees access training, attendance, and their status portal via unique token-gated links — not passwords. Tokens are single-use or session-bound, never embedded in public URLs, and cannot be guessed. This eliminates the risk of weak employee passwords while still providing secure, auditable access.
Where we are today — updated with each production deployment.
14-day free trial — no credit card, no commitment.
Sign in to your enterprise workforce & HRMS portal.
Enter your work or employee email and we'll send you an instant reset link.
Up to 100 Employees · No Credit Card Required
We sent a 6-digit OTP code to your email.
Schedule a 1-on-1 personalized walkthrough with an HR product specialist.