Protection enforced where the data lives

Every company's records are kept separate. Database rules check which company a person is working in before any record is read or changed. A person who belongs to more than one company chooses one deliberately.

Access comes from a person's position plus any personal changes made by an administrator. Customer financial details and pay information need their own separate permissions.

Changes, corrections and approvals are recorded. Many histories are append-only, meaning past entries cannot be edited or deleted.

Sensitive actions — such as time corrections, pay sign-off and publishing — require a person with the right permission.

Each company has a separate practice company with fictional data, so training and testing never touch real customers.

Outside connections are authorized per company. Sign-in tokens for connected services are encrypted and stay on the server. Incoming updates are signature-checked.

AI teammates work only with the access of the person asking and cannot see other companies' data.

Staff sign in with an email address on a domain their company has verified.