Seven modules. One rule each.

Records, departments, offices, reporting lines, and an org chart drawn from them.

Nobody changes their own job, department, manager or entitlement — the database refuses it.

Requests, balances from your own policies, manager-then-HR approval, per-office holidays.

Nobody approves their own leave, and no decision can be edited afterwards.

The handbook, published to everyone, with a record of who acknowledged which version.

An acknowledgement cannot be entered on somebody else’s behalf.

Pay components and payslips, kept apart from the rest of the record.

Pay needs a capability granted per person — being an administrator is not enough.

The activities your company logs, with the fields you choose, and the figures that follow.

Only the person whose day it is can write an entry.

An anonymous board for how people are actually doing, open to whoever you choose.

There is no author column, so no post can be traced to a person — not even by us.

Punching in and out, the hours that come from it, corrections when somebody forgets, and swapping a shift with a colleague.

Employees clock; they cannot rewrite the clock. Every correction records who made it.

Vacancies, a careers page, candidates scored against what the job asks for, interviews with scorecards, ending at an offer that starts somebody’s first week.

Closed by default, and a panel reads each other’s scorecards only after submitting their own.

A question about how the product works, answered in the terms of whoever asked.

It reads the documentation and your role. It cannot read your people, and it never decides anything.