Security

Who can see what

• Role-based access in both products: payroll, HR, finance, approver and self-service roles, plus custom roles with exactly the permissions you choose.
• Self-service staff see only their own payslips, leave, documents and requests.
• Each organisation's data is kept separate; every request is checked against the signed-in person's organisation.

Signing in

• Two-step sign-in with an authenticator app, with one-time recovery codes.
• Sign in with Google or Microsoft for organisations that use them; only people already invited can use it.
• Accounts lock for a while after repeated failed sign-ins; sessions can be reviewed and ended from Security settings.
• Passwords are stored only as salted hashes.

Checks on money

• Maker-checker approval on pay runs: the person who submits a run cannot approve it.
• Separation of duties on bills, purchase requests and expenses: no one approves their own.
• Approvals can only be decided once, even when two people act at the same time.
• Bank files are released only after approval, and payments are reconciled item by item.

A record of everything

• Audit logs of sign-ins, approvals, payments, exports and setting changes, visible to your admins.
• CAISE support sees only plan and usage counts unless your admin grants time-limited access, and every look is recorded in your audit log.
• Spreadsheet exports neutralise formulas so a downloaded file cannot run code.

Files and uploads

• Receipts and documents are checked by their content, not their name, and served only to people allowed to see them.
• Duplicate receipts are flagged to stop the same claim being paid twice.

Reporting a security issue

If you think you have found a vulnerability, please tell us before telling anyone else. Contact us with the details and we will reply within two working days.

For procurement and compliance teams

We can complete security questionnaires and provide a data processing agreement. Ask our team.