Platform
Roles and access
Roles decide what you can do; scoping decides whose data you can see. A token can never do more than the person it belongs to.
Roles
- A separate hr flag grants read access to every HR document without admin rights.
- A scoring exemption removes a person from every comparative and automated surface while an admin can still open their score on demand; a flexible flag silences strikes and nags without touching the score.
| employee | own data only |
|---|---|
| team_lead | self plus direct reports |
| manager | the whole managed tree; reports, exports, on-call writes, corrections for the team |
| moderator | admin-level visibility, but may edit only their own row; never nagged, never struck |
| admin | everything: bots, rooms, teams, providers, settings, audit log, API docs |
| superadmin | admin plus destructive org-wide maintenance, machine access; never tracked |
Scoping
Attendance, audit, employee detail, reports, exports and every roster-scoped endpoint apply the caller’s scope before returning data. An out-of-scope person returns the same not-found response as a nonexistent one, so response codes cannot be used to map the organisation.
Signing in
- One-time code by chat direct message: six digits, five-minute expiry, single use; three failures lock the profile for fifteen minutes; resend after sixty seconds. Every attempt is logged with IP and user agent.
- Trusted-device login for a device you use regularly.
- Password login exists as an option per team and is off by default; single sign-on is a plan feature on Enterprise and self-hosted.
- Sessions are an HTTP-only, same-site, secure cookie carrying a signed token; routes re-check the role in the database on every request, and rotating the signing key logs everyone out.
Personal API tokens
- Minted by a superadmin for a person; the plaintext is shown once and only a SHA-256 hash is stored.
- A token acts as its owner, so every role and scope check applies unchanged.
- Scopes are read or read and write; a read token is refused any request that would change something, before the route runs. An unknown scope falls back to read-only.
- Optional expiry; revocation takes effect on the next request; last-used is stamped so abandoned tokens are visible.
HR document vault
Kinds are doctor note, leave proof, contract, ID and other; files are capped at 20 MB, stored under an opaque name, and served back unchanged. Every upload, view and delete is audited. The product never reads the contents.
| admin | read all, upload for anyone, delete |
|---|---|
| manager and hr | read all, upload for anyone |
| employee | read and upload own |