Your data

What is stored

Your employee records and everything the product is for: leave, attendance, work logs, payroll, documents you upload, messages between your people, and an audit trail of who changed what. Nothing is collected that the product does not use.

Files — photographs, passports, certificates, payslip attachments — are in private storage. No bucket in this product is public; every file is served through a link that expires, issued only to somebody the policies admit.

Where

One Postgres database, in the region on your agreement, with backups in the same region. Your data sits in shared tables with a company column on every row and a policy on every table: a query that forgets to name your company returns nothing rather than somebody else’s. That is checked by tests that run on every change, company against company.

For how long

You choose, inside a ceiling we set, per kind of data — and a job applies it every day rather than somebody remembering. The kinds are:

• Messages
• Attendance punches
• The audit trail
• Employee documents
• Notifications
• Generated report files

Business records — payslips, leave, employee records — are not on that list. They are yours to delete, one by one, deliberately.

Who can reach it

Inside your company, whoever you give access to: roles decide the shape and a grant decides the exception, and a manager sees their departments rather than the company.

On our side, support staff can read a company only by entering it deliberately, with a reason, and the entry is written to your own audit log as well as ours. Acting inside your company — changing something — is the platform owner alone, for an hour at most, with a reason, and everybody who works there sees a banner while it is happening.

Who on our side holds which access is reviewed on a schedule and the review is recorded.

What happens when you leave

You take everything: a full export of your company, in files a spreadsheet opens, at any time and without asking us. Deletion is scheduled rather than immediate — a grace period during which you can change your mind — and when it runs, your company’s data goes.

What survives is the record that the company existed: the signup, our own audit entries, and the agreement history. We keep those because they are how we can still answer a question about the account afterwards, and they contain no employee data.

Somebody asking what you hold about them

Answered from the product: one file with everything the company holds about one person, built from the tables rather than from nine screens exported by hand, and recorded in your audit trail. Erasure names what must be kept — payroll records and the audit trail — and why.