Built like it holds payroll data.
Because it does.
Multi-tenant from day one, with isolation the database enforces — the same checks for the interface, the API, and anything else that asks.
Row-level security on every table
Every tenant table carries database-level policies. What you cannot see does not exist for you — rows, files, history and all.
Private files, signed per request
No public buckets, no forever-links. Every download re-checks who is asking, and file names never leak into logs or emails.
History that cannot be edited
An append-only audit trail of every change, grant and approval — and history is gated by the same visibility rules as the data it quotes.
Restricted columns disappear
A salary column no one should see is not blanked out — it is entirely absent, title and all. Blanked cells still tell a story.
Three layers ask.
One layer decides.
The interface hides what you cannot use, the API refuses what you cannot do — and the database enforces both, so a hand-crafted request hits the same wall a hidden button does. A rule that only lives in the UI is not a rule.