Security and data protection
Security is built into the database itself, not just the sign-in screen.
Isolation between companies
Every table that holds company data is tied to the company's ID, and the database (PostgreSQL) applies a Row‑Level Security policy to every query. The application connects with an account that cannot bypass that policy, and automated tests check that no company can see or change another company's data.
Audit log
Every change to performance data is recorded in the same transaction, with who made it and when. The application's account can only add to the log; it cannot edit or delete it.
Sign-in and permissions
Permissions by role: owner, HR, advisor, sector head, department head and employee. Repeated sign-in attempts are throttled, and sessions are encrypted.
AI
Text your company writes is sent to the model as data, not instructions, and the output stays a draft until a responsible person approves it. AI usage has a monthly limit per company.
Hosting
The platform runs on dedicated servers with daily backups. Hosting inside the UAE and Saudi Arabia, and ISO 27001 certification, are planned for 2027.
Have a security question or need a security questionnaire filled in? Write to us.
Contact us