Security and trust
Salary, bank and identity fields are encrypted with a key that belongs to your organisation alone. Every change is written to a tamper-evident trail. And because no honest security page is only good news, the second list below is what this deployment does not yet do — the same list your own administrators see inside the product, on Settings → Security.
Every table carrying customer data has row-level security enforced by PostgreSQL itself, not by application code remembering to add a filter. The application connects as a role that cannot bypass it, so a query that forgets the organisation returns nothing rather than somebody else’s rows.
Salary, bank details, PAN and Aadhaar are encrypted with a key belonging to your organisation alone, wrapped by a root key. Somebody holding a copy of the database holds ciphertext.
Every consequential action is written to a hash-chained log — each entry carries the hash of the one before it, so removing or altering an entry in the middle is detectable rather than invisible. You can read yours; so can your auditor.
A POSH complaint can be read only by somebody serving on your Internal Committee who has not recused themselves from that case. No administrator role can read one, including the owner of the account, and neither can we. A refusal looks identical to the complaint not existing, because “you are not allowed to see this” would confirm there is something to see.
When we need to look at your tenant to diagnose something, the session is read-only, expires, and is written into your own audit trail where you can see who looked and why.
A full export of every record, in open formats, available whatever your subscription is doing — including after it has lapsed. An export behind a paywall is a hostage.
Said plainly
Payroll’s statutory outputs have not been reviewed by a chartered accountant and are not described as compliant. The engines compute EPF, ESI, professional tax by state, labour welfare fund and TDS, and a review is the next thing scheduled. Run it alongside whatever you use today until you are satisfied.
The cross-tenant access log is best-effort rather than fail-closed. A support session that could not write its log entry proceeds anyway, because a logging failure taking down an engineer mid-outage is the worse trade. It means “every access is logged” is true in practice rather than guaranteed under failure.
Each deployment publishes its own list. Inside the product, at Settings → Security, is every guarantee that particular deployment is not currently keeping — the email driver, the file scanner, the job runner, the storage backend. It is generated from the running configuration rather than maintained by hand.