Admin & security
Built for the people who run it
Four roles that match how HR works, an append-only activity log, two-factor auth, and tenancy enforced on every query.
Roles without a “manager” role
Owner, Admin, HR and Employee. HR means workforce management, not system configuration: employees and invitations, policies, leave types, chains, blackouts and holidays, requests and reports — but not locations, departments, onboarding, member roles or the activity log. HR cannot promote anyone to admin, by design.
There is no manager role. Approval rights come from reporting lines. The same rule file drives the server's permission gate and the browser, so the command palette only ever shows pages you can open.
Every change on the record
The activity log is an append-only record of changes across the organization: event, actor, target and time, with a details dialog for the full payload. Filter by event, actor, target and date range. Scheduled jobs appear as the System actor. Owners and admins can read it; nobody can edit it.
Accounts
Email verification is required before a first sign-in. Two-factor authentication uses an authenticator app with backup codes, and an emailed code as fallback. Google sign-in links to an existing account with the same email. Every active session is listed and can be revoked.
Session cookies are HTTP-only and SameSite=Lax, and marked secure in production.
- Email verification
- Required before first sign-in
- Two-factor
- TOTP app + backup codes, email code fallback
- Sign in or link to the same email
- Sessions
- Listed per device, revoke any
Tenancy and files
Every organization-scoped query carries the organization id from the session — never from the client — so one tenant can't read another's data by changing an id. Files live in a private bucket behind five-minute upload links and sixty-second download links, and downloads are always served as attachments.
Deleting the organization is owner-only. Requests and balances export to CSV whenever you want them. Behind the scenes, three job queues with a per-minute heartbeat run the nightly work, and every job is idempotent.
FAQ
Admin & security, answered
Can HR promote someone to admin?
No, by design. HR has no grant over member roles, so an HR account can't escalate its own access or anyone else's.
Is there SSO or SAML?
Not yet. Today: email and password with mandatory verification, two-factor, and Google sign-in.
Where does my data live?
In the hosted service. Self-hosting on your own infrastructure is on the roadmap; either way, your requests and balances export to CSV at any time.
Ready to stop chasing time-off spreadsheets?
Set up your workspace in minutes. Your data stays yours — export anytime, delete anytime.
Start free in the cloud