This page is written to be forwarded. It describes the controls that exist today — no roadmap items presented as shipped, and no compliance badges we don't hold.
Over 40 permission keys live in one shared catalog. The same keys gate the HTTP API and the UI, so a capability cannot be granted in one surface and forgotten in the other. Roles are compositions of keys; custom roles are available on the Operate tier.
Permission keys grant capability, never reach. Anything acting on a specific employee — approving their leave, reading their file, fixing their punch — additionally passes a scope check: self, direct-report subtree, or an explicit HR override. The check is per action, not per page.
Sessions are carried in a signed, httpOnly cookie and can be revoked server-side at any time. Login is rate-limited per account and per IP.
Public API keys are hashed at rest and shown exactly once, at creation. Each key carries its own scope and a 600 requests/minute limit. Revoking a key takes effect immediately.
Nine events are delivered with an HMAC-SHA256 signature header so you can verify origin. Failed deliveries retry with backoff, and each hook exposes its own health status.
Every mutation is written to an audit log with actor, target, before and after. It is filterable and exportable, per employee or across the org.
Your data leaves in CSV any day you want — employees, punches, approvals, payroll runs and the audit log itself.
Security questions, or a disclosure to report? Write to our security contact — we answer in writing.