Security, Access & Compliance — ERP security, access control and data-protection compliance
For companies that must answer who can see this, who changed it and where does our data live to an auditor, a board or a regulator. It covers signing in and account protection, roles and fine-grained permissions, separation of duties, network limits, a change history with an optional tamper-evident chain, privacy requests under the UAE Personal Data Protection Law (PDPL), backups and data location, and the controls the platform's own operators work under. It is part of every workspace and is not a separately licensed app, but some pieces need another app (privacy requests live in HR, file storage in Documents) and some are still assisted rather than self-service: this page says which.
Last updated
No credit card · Ready in about a minute · Your data stays private
194 features in 16 areas · works with 15 other modules · 12 team workflows
Full feature list
Signing in
How people reach their company's workspace, and how that door stays theirs alone.
- Each company has its own sign-in address — Every company signs in at its own web address, and the Company field on the form is locked to it. A password stolen from one company is refused on another company's address.For: Employee, Tenant admin
- Email and password sign-in with safe error messages — A wrong password and an unknown account show the same message, so the form does not reveal who works at your company. A deactivated or locked account is told so in plain words.For: Employee
- Your company's logo and name on the sign-in page — The sign-in page shows your company's own logo and display name before anyone signs in, so staff know they are in the right place.For: Employee, Tenant admin
- Sign in from the main address and land in your company — Someone who signs in at the main address is carried to their own company's address with a one-time code that works for two minutes, so the session is created on the right address and never travels in the link.For: Employee, Tenant admin
- Stay signed in without retyping the password — Access is renewed quietly in the background for up to 30 days. When renewal is no longer possible the person is sent back to sign in with a clear session-expired notice instead of a broken page.For: Employee
- Forgot-password by email — People ask for a reset link from the sign-in page. The link works once and expires after 30 minutes, and the page gives the same confirmation whether or not the account exists, so it does not reveal which addresses have accounts.For: Employee
- One reset email per minute, one live link at a time — Asking again within a minute sends nothing extra, and every new request cancels the earlier link, so a forgotten old email cannot be used later and a mailbox cannot be flooded.For: Employee
- Resetting a password signs out every device — When a reset is completed, every other session of that person ends at once and they get a password-changed notice, so someone who hijacked a session loses it.For: Employee
- Change your own password — In My profile a person changes their password after proving the current one. Every other device is signed out and a notice goes to their inbox, so an unexpected change gets noticed.For: Employee
- Passwords stored as one-way hashes — Passwords are stored with the Argon2id method and cannot be read back by staff, administrators or the vendor. A new password must be at least 10 characters (a company may choose 8 to 128) and may not be the person's e-mail address; character-mix, rotation and reuse rules are not enforced. Signing in never checks the length, so an older, shorter password keeps working until it is changed.For: Tenant admin
- Arabic and English sign-in with right-to-left layout — The sign-in, password-reset and settings screens are translated into Arabic and switch to right-to-left layout, so Gulf teams work in their own language.For: Employee, Tenant admin
Account protection
What stops a guessed or stolen password from becoming a breach, and what an administrator can do when it happens.
- Account lock after five wrong passwords — Five wrong passwords in a row lock the account for 15 minutes, and even the correct password is refused during the lock. The person is told by email, and a successful sign-in resets the count. Five wrong authenticator codes lock it the same way, and the message then says the codes were wrong, not the password. Resetting the password with the e-mailed link lifts the lock at once.For: Employee, Tenant admin
- Unlock an account straight away — An administrator clears a lock from the Users list instead of making the person wait. The unlock option only appears on accounts that are really locked, and the action is recorded at a high severity.For: Tenant admin
- Alert on an unfamiliar network or device — Each sign-in is compared with the person's previous one. A new network or a new browser raises an alert to the person by email and a high-severity entry in the security feed, without blocking the sign-in.For: Employee, Tenant admin, Platform operator
- Security emails go to the person concerned — Lock-outs, unfamiliar sign-ins, password changes and new API tokens are emailed to the person whose account it is, never to a manager or administrator, so the owner is the first to know.For: Employee
- Authenticator app with backup codes — Anyone sets up an authenticator app on My profile by scanning a QR code and receives ten single-use backup codes, shown once. From then on every password sign-in asks for the app's 6-digit code, or one of the backup codes; each code works once, and wrong codes count toward the account lock. A support session cannot set it up or read new codes for the person.For: Employee, Tenant admin, Platform operator
- Regenerate backup codes — A person who has used several backup codes, or is unsure where the originals went, types the code their authenticator app shows now and gets a fresh set of ten. The old codes stop working immediately and the change is recorded; without a current code nothing changes.For: Employee
- Replace a lost phone without a support ticket — When someone loses the phone and the backup codes, an administrator removes their authenticator from the Users list. The confirmation warns that this lowers the account's protection, because fooling an administrator is the obvious attack, and the removal is recorded permanently.For: Tenant admin, Employee
- Send a password reset from the Users list — An administrator emails someone a single-use reset link with one click. The administrator sees which address it went to, and any earlier link for that person stops working.For: Tenant admin, Employee
- Set a password directly as a last resort — When the mailbox itself is the problem, an administrator sets a new password. All of the person's sessions end, earlier reset links are cancelled, the person is told, and the action is recorded at the highest severity and kept for good.For: Tenant admin
Sessions and instant sign-out
Control over where a person is signed in, and the ability to end a session the moment it should not exist.
- Sign-outs take effect in seconds — Signing out, ending a session, changing a password, archiving a person or suspending a company cuts off access within a few seconds across the whole product, not when a 15-minute pass would have expired. Outside apps lose access at the same moment: signing out or ending a session stops the apps that sign-in approved, and a password change, a disabled or archived account or a suspension stops all of them.For: Tenant admin, Employee
- Access changes apply on the next click — Taking a permission off a role or adding one, archiving or deleting a role, or changing the roles a person holds applies from that person's next click on every screen, with no waiting and no signing in again. Their menus and buttons catch up on the same click and they are told when access was taken away; if the change cannot be recorded at once, the administrator is told it can take up to 30 seconds.For: Tenant admin, Employee
- See where a person is signed in — The Devices action on the Users list shows every live sign-in of a person, named by browser and device, with the network address, when it started and when it was last active, so an administrator can answer where an account is in use before acting.For: Tenant admin
- Sign a person out of every device — One action on the Users list ends all of a person's sessions. It asks for confirmation naming the number of devices, and appears only when the person has live sessions.For: Tenant admin
- Limit how many sessions one person can hold — A person can hold 25 live sessions by default; a new sign-in beyond the limit ends the least recently used one. The number is a company setting, changed through the settings programming interface (API) because there is no screen for it yet, and zero removes the limit.For: Tenant admin
- Expired sessions are cleaned up hourly — A scheduled job deletes expired and revoked sessions every hour, so the live count on the Users list is real and the session records do not grow without limit.For: Tenant admin
- Renewal keys that work only once — Each renewal replaces the previous key. If an old key is presented again, as would happen with a stolen copy, it is refused and a security entry is raised for review.For: Employee, Tenant admin, Platform operator
- Credentials signed by one service and checked everywhere — Sign-in credentials are signed with a private key that only the sign-in service holds. Every other service only has the public part and can check them, so a breach in one service cannot forge a login.For: Tenant admin, Platform operator
- A renewal key cannot be used as a work credential — Each credential names what it is for. A long-lived renewal key is accepted only for renewing, so stealing one does not give access to the data.For: Tenant admin, Platform operator
- See and end your own sign-ins — On their own profile page, each person sees every browser and device signed in to their account, with this browser marked, the network address, and when each one signed in and was last active. They sign out any one of them, or all the others at once, and that device is cut off within seconds.For: Employee, Tenant admin
Single sign-on (SSO)
People sign in to the workspace with the identity system the company already runs — Microsoft Entra ID, another OpenID Connect provider or SAML 2.0 — which the company administrator connects, tests and maps to roles in Settings, and staff sign in to outside services with their workspace account.
- Set up single sign-on yourself in Settings — Settings → Security & audit → Single sign-on is where the company administrator connects the identity provider, copies the values it needs and tests the connection, without a support ticket. Seeing the page, testing and saving are separate permissions held by the company administrator, saving a connection also needs the right to give roles, and a switch in Settings → Features turns single sign-on off while passwords keep working.For: Tenant admin
- Connect Microsoft Entra ID (Azure AD) — The administrator types the directory ID or a verified domain and the application ID, and the issuer and every other address are found for you, on Microsoft's worldwide, US Government or China (21Vianet) cloud. The page lists the values to paste into Entra, each with a copy button, and a Grant admin consent link.For: Tenant admin
- A certificate instead of a client secret — Entra can be connected with a client secret, which is stored sealed and only ever shown masked, or with a certificate the page generates, which signs each request so there is no password to expire quietly. The page warns 30 days before a secret or certificate runs out.For: Tenant admin
- Only your own directory's people get in — A person is recognised by Entra's directory ID and object ID, never by an e-mail address that can change hands. A sign-in from another organisation's directory is refused, and so are guests invited from other organisations unless the administrator allows them.For: Tenant admin, Employee
- Require multi-factor sign-in at the provider — An option refuses a single sign-on unless the identity provider reports that the person completed a second step, such as an authenticator prompt. It is off by default; at single sign-on the provider's second step takes the place of the workspace's own authenticator code.For: Tenant admin
- Any other OpenID Connect provider — Okta, Google Workspace, Keycloak and other OpenID Connect (OIDC) providers connect from their issuer address, and the other addresses are discovered. Every sign-in carries a one-time value and a Proof Key for Code Exchange (PKCE) and checks the provider's signature, issuer, audience and expiry with no unsigned fallback, and every provider address is checked against the platform's network guard.For: Tenant admin
- The return address is only your own sign-in page — Another OpenID Connect provider can send people back only to the company's own sign-in page; a different address is refused when it is saved and again when the sign-in starts, and the page never asks for one.For: Tenant admin
- Trust e-mail addresses from your own directory — An e-mail address connects someone to an existing account only when the provider vouches for it. For another OpenID Connect provider that is the company's own directory but does not confirm addresses, the administrator can turn on Trust e-mail addresses from this provider; it is off by default and never offered for Entra.For: Tenant admin
- "E-mail not confirmed" always wins — If the provider says a person's e-mail address is not verified, that is never overridden: even with Trust e-mail addresses from this provider on, the person is refused rather than connected to an existing account.For: Tenant admin, Employee
- SAML 2.0 sign-in with its own settings card — For a provider that cannot do OpenID Connect, Security Assertion Markup Language (SAML) 2.0 is set up on its own card from the provider's metadata address, a pasted metadata file or values typed by hand, and the sign-in page then shows Sign in with SAML. A provider set up from a metadata address is re-read daily and every certificate it lists is accepted, so a certificate rollover needs nobody.For: Tenant admin
- SAML replies checked against forgery and replay — Each reply must hold exactly one signed assertion whose signature and digest verify under exclusive canonicalisation; SHA-1 is refused, signature-wrapping tricks are caught, and the issuer, audience, recipient, the request it answers and its validity window are all checked. The sign-in finishes only in the browser that started it.For: Tenant admin, Employee
- A SAML reply must answer our sign-in, and works once — A SAML reply must answer a sign-in this company started and works once: a reply that answers no sign-in of ours, or one used a second time, is refused even when it is correctly signed.For: Tenant admin, Employee
- Test sign-in without signing anyone in — A test makes a real round trip to the provider and reports who it says you are — directory, guest or not, multi-factor, groups and app roles — and what a real sign-in would do: sign in, connect an existing account, create one, or refuse and why. Nothing is created or changed.For: Tenant admin
- Roles that follow your directory — The administrator maps an Entra group's object ID or an app-role value to a workspace role. With Keep roles in step with the directory on, roles follow the directory at every sign-in and every provisioning change; roles given by hand are never removed, and neither is the company's last role administrator.For: Tenant admin
- Group lookups for people in many groups — When a person belongs to more groups than one sign-in can carry, their groups are read from Microsoft Graph, which needs the GroupMember.Read.All permission with admin consent; without it the sign-in is refused with an explanation. App roles have no such limit.For: Tenant admin
- Create accounts on first sign-in — Off by default. When on, someone from the directory with no account gets one at their first sign-in, using a seat of the licence and the default role for new accounts, and HR is told so it can link their employee record; without a default role, a person whom no mapping gives a role is refused before an account is made.For: Tenant admin
- First-sign-in accounts only for your own e-mail domains — For another OpenID Connect provider or SAML, Create accounts on first sign-in needs a list of the company's e-mail domains; an empty list creates nobody, public mail services are refused, and someone from any other domain is told to ask their administrator and uses no seat. Connections that had the option on without a list were switched off by the update. Microsoft Entra needs no list because it is already limited to your directory.For: Tenant admin, Employee
- Sign-in buttons appear only when set up — The sign-in page shows Sign in with Microsoft, Continue with single sign-on or Sign in with SAML below the password form, only for a connection that is switched on. People press it, sign in at the provider as usual and come back signed in.For: Employee
- The same checks as a password sign-in — Every single sign-on honours the company's network access rules, a locked or switched-off account and a suspended company exactly as a password sign-in does. Every sign-in, refusal, settings change and provisioning action is written to Settings → Security log with a plain reason.For: Tenant admin, Employee
- Disconnect one person's single sign-on — From Settings → Users an administrator removes a person's link to the identity provider, for example after their directory account was recreated. The account, its roles and its password stay.For: Tenant admin
- Single-use sign-in requests — Each SSO round trip carries a one-time state value that expires after ten minutes, so a captured sign-in link cannot be replayed.For: Tenant admin
- Sign in to other apps with the workspace account — The workspace acts as an OpenID Connect sign-in provider, so outside services that support it let your people in with their workspace account. An administrator adds the app in Settings → Security & audit → Sign in to other apps and pastes a client ID, a client secret shown only once and the workspace's discovery address into the service; people are then sent to the workspace, sign in if they need to and come straight back with their email and name. Every built-in staff role may use the apps, an administrator can change that per role, and the switch is in Settings → Features. Each workspace signs these sign-ins with its own key, so a sign-in from one workspace is never accepted as one from another, and an administrator can replace the key from the same page.For: Tenant admin, Employee
- An outside app's access ends when the sign-in ends — What an outside app receives belongs to the workspace sign-in that approved it. Signing out, an ended session, a password change or reset, a disabled or archived account, a suspended workspace or a role that no longer allows outside apps stops it at once: the app can no longer read the person's details, and the person has to sign in to the workspace again before the app can ask about them. A session the app keeps on its own side is ended by that app.For: Tenant admin, Employee
Automatic account provisioning (SCIM)
With System for Cross-domain Identity Management (SCIM) 2.0, the company's identity provider creates, updates and switches off accounts and groups by itself, so a person who leaves loses access without anyone remembering to do it.
- Connect Microsoft Entra provisioning with a token — The administrator copies the address on the Provisioning (SCIM) card and makes a token to paste into Microsoft Entra ID; it follows Entra's way of speaking SCIM, and other SCIM 2.0 clients work too. Provisioning works with or without single sign-on, and a switch in Settings → Features turns it off.For: Tenant admin
- Tokens shown once and stored hashed — A provisioning token starts with tlscim_, is shown only once, is kept only as a one-way hash and works only on the company's own address. At most five are live at a time, each can be revoked at once, and making one needs the right to give roles, because directory groups give roles.For: Tenant admin
- Accounts created and updated by the directory — When Entra assigns a person, an account is made with their name, e-mail and a default role, the company's seat licence applies, and HR is told so it can link their employee record. Later changes to the name, e-mail or directory identifier follow by themselves.For: Tenant admin
- Switching someone off ends their sessions — When the directory switches a person off, the account is switched off and every session ends at once; a deletion keeps the record, switched off, rather than erasing it. The company's last role administrator can never be switched off this way.For: Tenant admin
- Groups and members kept in step — Groups and their members are created, changed and removed by the directory, matched on the Entra group's object ID, and the role mappings are re-applied to the people affected.For: Tenant admin
- Provisioning changes only what it made or was handed — The directory can find, change or switch off only the accounts it created itself and the ones an administrator hands to it; an account someone made by hand is never taken over because the directory sends the same address. A group's member list shows only the accounts the directory manages.For: Tenant admin
- Link requests, linked accounts and giving back — When the directory asks for an address that already has an account, it is told no and a request appears under Settings → Single sign-on. The administrator links one account, or reviews and links all after a check, dismisses a request, or gives an account back. Only a person's own click does this: not the Copilot, an API token or impersonation. Each step is in the Security log.For: Tenant admin
- Administrators stay managed by hand — The directory never links or changes an administrator's account and never gives an administrator's role through a group. An administrator made by hand reads to it as no such account, a managed account later made an administrator is refused, and every refused change is recorded in the Security log.For: Tenant admin
- A provisioning token ends with its maker's rights — A token stops working the moment the person who made it is switched off or removed, or loses the right to manage provisioning or to give roles, and works again if the rights return, so a departing administrator leaves no live key behind.For: Tenant admin
People and accounts
Creating, inviting, finding and managing the people who can sign in.
- Add a person with their roles — An administrator creates an account with name, email, a starting password and one or more roles in a single step. Giving roles needs the separate role-assignment permission.For: Tenant admin
- Invite the team during setup — The setup wizard creates an account per colleague with their role and emails each a link to choose a password. A row with a missing name or email is flagged instead of half-sent.For: Tenant admin
- Re-send an invitation — The Users list has a button that re-sends the invitation email to any active person; for someone who has never signed in its tooltip says so. The Email a single-use password reset link action reaches the same person with the standard reset email.For: Tenant admin
- A Users list that shows security posture — The list shows last sign-in (with Never as an answer), authenticator and passkey counts, live sessions, lock state, failed attempts and unaccepted invitations, so one screen answers what an access review asks.For: Tenant admin
- Find the people who need attention — A security filter lists people who never signed in, whose invitation is unaccepted, who have no authenticator, who are locked, or who are administrators. Sorting puts never-signed-in people first on purpose.For: Tenant admin
- Choose which columns the list shows — Each administrator picks the optional columns, such as last sign-in or live sessions, and the choice is remembered in that browser.For: Tenant admin
- Deactivate and reactivate a person — Deactivating someone stops them signing in or renewing a session without deleting any history, and reactivating restores access. Changes that alter who holds a sensitive permission are recorded.For: Tenant admin
- Archive a leaver and keep every record — Archiving a person ends all their sessions at once and keeps their history and records, and the person can be restored later. There is no button for it yet: it is available through the programming interface (API) and the AI Copilot, and the platform can switch the archive feature off.For: Tenant admin
- Delete an account — An administrator with the delete permission can remove an account entirely. Removing the roles a person held is checked against the sensitive-permission watch.For: Tenant admin
- Link a login to an employee record — A person's login and their HR employee record are joined, so My team, My requests, My time and every other personal screen recognise who is asking. A login without the link sees an empty state that names the fix. The link is set through the AI Copilot or the programming interface (API); the Related user field on the employee settings tab is a separate field and does not create it.For: HR manager, Tenant admin
- See your own roles and permissions — My profile shows the roles you hold and how many permissions they add up to, next to where you change your name and password, so you can tell why a button is missing before asking an administrator.For: Employee, Tenant admin
- Platform operators can help with a stuck account — When a company's only administrator is locked out, a platform operator can reset a password, send a reset link or remove an authenticator for that person, each recorded.For: Platform operator
- Colleagues' roles stay private — Looking someone up, for example in a people picker, shows their name, e-mail and status. The roles they hold are shown only to that person and to people who manage accounts.For: Every user, Tenant admin
Roles and permissions
Deciding exactly what each person may see and do, in every module, and being able to prove it.
- Permissions in plain module, record and action terms — Every action is its own permission, written as module, record type and action, for example payroll run approve. The product ships well over a thousand of them, so a role can be as narrow as the job.For: Tenant admin
- Built-in roles for common jobs — More than forty ready-made roles cover HR, payroll, finance, sales, projects, fleet, point of sale, rentals and more, each with sensible permissions. Every company gets its own editable copy.For: Tenant admin
- Edit a built-in role — A company tailors its copy of a built-in role by ticking permissions on or off. The people holding the role have the change from their next click, and the platform's original is untouched.For: Tenant admin
- Create custom roles — An administrator builds a role such as Senior HR analyst from scratch or by cloning an existing one, names it, and picks its permissions from a tree grouped by module.For: Tenant admin
- Give a role to people from the role page — The role page of a custom role lists who holds it, and an administrator adds or removes people there. A person can hold several roles and gets the combined permissions.For: Tenant admin
- See why someone can or cannot do something — For any person the AI Copilot or the programming interface (API) returns the combined permissions from every role they hold and which roles contributed, which turns it cannot approve into a clear reason. The Roles screen itself lists each role's people and permissions but has no per-person explanation yet. Explaining someone else needs the permission to read roles, which HR managers hold; everyone can ask about themselves.For: Tenant admin, HR manager
- Retire a role without losing history — Roles are archived rather than deleted, so people and past audit entries that refer to them still make sense, and an archived role can be restored.For: Tenant admin
- Only roles for apps you hold are listed — The role list hides roles that belong to apps your company does not have, so the screen is not cluttered with fleet or point-of-sale roles for a company without them.For: Tenant admin
- Screens hide what you may not use, and the server still refuses — Menus, buttons and pages disappear for people without the permission, and the server checks again on every request, so editing the address bar or calling the system directly gets a refusal.For: Employee, Tenant admin
- Managers see only their own departments — A manager's default access to employee records is limited to the departments they manage. Wider access has to be granted on purpose, and approval steps follow the same department.For: Manager, HR manager
- Employees get self-service access by default — The Employee role gives access to a person's own profile, time, requests, payslips and similar screens and nothing about colleagues beyond the name pickers every form needs.For: Employee
- Access review banner on the Roles page — The Roles page flags roles holding a very large number of permissions and custom roles nobody holds, and an Access review button hands that list to the AI Copilot to discuss.For: Tenant admin
- Every role change is recorded and kept — Each grant, revoke or permission change writes an audit entry naming who did it, kept permanently, because who could do what, and since when, is something auditors ask years later. These entries are held by the platform and are not yet listed on the Settings, Audit log screen.For: Tenant admin
- The company always keeps someone who can manage roles — A change that would leave nobody able to edit roles is refused and nothing is saved: emptying the administrator role, or archiving, disabling, deleting or re-roling the last person who holds that power. A stray click cannot lock the whole company out of its own access settings.For: Tenant admin
- Role names that cannot be confused — A new or renamed role needs a clear name of 2 to 64 characters that does not repeat a built-in role or another role of the company, so an approval step or a shared document that names a role always means one role. A role is created whole or not at all.For: Tenant admin
- Save is shown only to people who may change the role — The Roles screen shows Save permissions only to someone who may change that role. A person who can only read roles, such as an HR manager, sees the roles, their permissions and the access review, with no Save button to press.For: HR manager, Tenant admin
Separation of duties
Making sure the person who prepares something is not the person who approves it, and watching the permissions that can read private data.
- Maker-checker control for accounting — When switched on in Finance settings, the person who created a journal entry, supplier bill, expense claim or payment batch cannot post or approve it, whatever their role allows. Companies with a controller turn it on; it is off by default so a one-person company can approve its own work.For: Finance controller, Accountant, Tenant admin
- Maker-checker control for payroll — When switched on in Payroll settings, the person who created a payroll run or final settlement, or requested a loan, cannot be the one to approve, pay or post it. The refusal tells the person why.For: Payroll manager, Tenant admin
- Small entries can skip the second pair of eyes — A company can set an amount below which an accountant may post their own journal entry even with the control on. Zero, the default, means every entry needs a second person.For: Finance controller, Tenant admin
- Watch who can read everyone's private messages — Granting the permission to read all direct messages, or removing it, is recorded as a critical, permanent entry naming who made the change, and Chat administration flags anyone who gave themselves the role. It records the grant; it does not stop an administrator making it.For: Tenant admin, Chat administrator, Auditor
Network access and data isolation
Where requests may come from, and why one company can never see another's data.
- A separate database for each company — Each company's business records live in its own database, not in shared tables with a company label. A bug in one report cannot show another company's rows, because they are not there. Sign-in accounts, settings, the licence and the audit trail are kept by the platform.For: Tenant admin, Platform operator
- Company address checked on every request — On top of sign-in, every request is checked against the company address it came from. A valid login used on another company's address is refused with a 403 and a high-severity entry is recorded. Platform operators are exempt.For: Tenant admin, Platform operator
- Allow only your office networks — An administrator lists the address ranges people may sign in and work from, with a label. Everyone else is refused, at sign-in and on every request. Turning it on needs the platform's network front to confirm your own address, and the screen says whether it can; where it cannot, the switch refuses. Platform operators and support sessions are exempt.For: Tenant admin
- Test an allowlist before enforcing it — A monitor mode lets the lists run in rehearsal: nobody is blocked, but every sign-in or request that would have been blocked is recorded. It is switched on through the settings programming interface (API); the Network access screen has no switch for it yet.For: Tenant admin
- Safeguards against locking the company out — Turning the allowlist on needs a typed confirmation, adds the administrator's own address automatically, and refuses when that address cannot be verified. Blocking a range that contains your own address is refused, and deleting the last rule that covers you asks for an explicit override.For: Tenant admin
- Block named addresses for one company — Individual addresses or ranges can be blocked for a company, for example one that is probing the sign-in page, and the block applies even when the full allowlist is not switched on.For: Tenant admin
- Emergency switch-off by the platform operator — If a company arms the allowlist and still gets locked out, a platform operator, who is exempt from it, can turn it off for that company. This is done through the administration interface (API); there is no operator screen for it.For: Platform operator
- Unlicensed apps are refused with an upgrade message — A request for an app the company does not hold gets a clear payment-required answer, and the screen shows an upgrade prompt, instead of a confusing error or a half-working page.For: Employee, Tenant admin
- Suspended companies are stopped everywhere — When a company is suspended, its people are refused on the next request and their sessions end within seconds. Reactivating restores access.For: Platform operator
- Stored secrets are masked and cannot be read back — Storage keys, integration credentials and database passwords are stored encrypted and shown masked. Saving a form without retyping a secret keeps the stored value, so it cannot be overwritten by accident.For: Tenant admin
- Public pages and customer portals are walled off — Customer and partner portals sign in with their own separate credential, so a portal visitor cannot reach staff screens even with a valid portal login.For: Employee
API tokens and outside connections
Letting outside tools and AI assistants work with your data without handing over a person's password.
- Create API tokens with a name, scope and expiry — A person with the token permission creates a long-lived token for an outside application, chooses which tools it may use, and sets an optional expiry and rate limit. The secret is shown once and only a fingerprint is kept. In a company set up from now on an HR manager can create tokens and review or revoke their own, while the company-wide list and revoking anyone's token stay with administrators.For: Tenant admin, HR manager, Project manager
- Revoke a token instantly — Revoking a token stops the next request from that application. The list shows when each token was last used, so unused tokens are easy to retire.For: Tenant admin, HR manager
- People can see and revoke their own tokens — Project members and managers hold the own-token permissions: they can review and revoke only the tokens they created, without being given administrator rights.For: Project member, Project manager
- Tell the person when a token is created — The person who creates an API token gets an email and an in-app notice naming it, so a token made from a hijacked session is noticed.For: Employee, Tenant admin
- Block whole apps or single tools from outside AI — A company-wide deny list switches off chosen modules or individual tools for every outside agent and token. It only ever narrows access; it never grants anything a person lacks.For: Tenant admin
- Outside tools obey licence and permissions — A token cannot reach an app the company has not licensed or an action its owner may not do. Tokens of a suspended company stop working, and addresses on the platform block list are refused.For: Tenant admin
- Keys and integrations change only in a person's own browser — Saving, removing or switching an integration, restoring a backup and turning on built-in storage are offered only in Settings. An outside AI app or an AI agent is refused for all of them, and an API token or support signed in as you cannot save, remove or switch an integration; nothing runs. Any password, key or token passed to a tool is stored as [redacted] in the audit record of the call.For: Tenant admin
- Marketplace apps connect through a consent step — Installing a marketplace app either sends the administrator through the vendor's own consent screen or creates a token for an open-source tool, and every installation has an audit trail and can be revoked.For: Tenant admin
- Nightly data export for reporting tools — A company's HR, accounting, attendance, learning and project data can be exported every night as files for tools such as Tableau, Power BI or Metabase. Administrators and HR managers list recent runs and get a one-hour download link, and a separate switch decides whether payroll tables are included. There is no screen for it yet: it is used through the programming interface (API).For: Tenant admin, HR manager
- An integrations screen that says whether each connection works — One list shows every outside system the company is connected to, whether it is healthy, the last error and whether a credential is stored. Test and call logs answer is it working before the next failed send.For: Tenant admin
Audit trail and change history
A record of who did what, what the value was before, and proof that the record itself has not been altered.
- One audit log screen — Settings, Audit log merges the HR, attendance, project and field-level change records into one list, filtered by module, action, person and date range, and exported to a CSV file for the audit pack. It needs the audit permission; HR and project sources appear only for companies that hold those apps. Security administration entries (users, roles, tokens, network rules) are not on this screen yet.For: Tenant admin, HR manager, Auditor
- Before-and-after values for each change — A change history records the old and new value of each field that changed, and a full copy of a row that was added or deleted. It is captured by the database itself on every tracked table, so no screen, import or script can skip it.For: Tenant admin, Auditor
- New tables are covered automatically — After every product update the system attaches the change history to any new table, so new features are not silently left out of the trail.For: Tenant admin, Auditor
- Passwords and secrets are masked in history — Fields that hold passwords, tokens, keys or codes are masked before the old and new values are compared. The history shows that a key changed, never what it was.For: Tenant admin, Auditor
- Who made the change — When a change is made through the application the person who made it is named in the history, along with the time. A change made outside the application is recorded without a name, or with the name stored on the row, rather than a guessed one.For: Tenant admin, Auditor
- History and discussion on each record — Records in supported modules carry a history tab showing what changed and by whom, next to a discussion thread, so the story of a record is in one place.For: Employee, Tenant admin
- Purpose and legal basis on audit entries — Each audit entry records the purpose, the legal basis (contract, consent, legal obligation and so on), whose data was touched, the country and when it may be destroyed, and one of four severity levels, which is what data-protection regulators look for.For: HR manager, Tenant admin, Auditor
- Retention you control — Each audit entry is stamped with a keep-until date, six years by default, which a company changes through the settings programming interface (API) to match its own legal advice. Terminations, destructions and security-critical acts are stamped to be kept permanently. Nothing deletes audit entries automatically today.For: Tenant admin
- Tamper-evident audit chain — With the chain switched on, each audit entry carries a fingerprint that includes the entry before it, so deleting or inserting a row breaks the chain and shows up. It is off by default and switched on through the settings programming interface (API); there is no screen for it yet.For: Tenant admin, Auditor, Compliance officer
- Chain check that raises an alarm — A platform operator can verify a company's audit chain; any break raises a critical security entry. This check is available through the administration interface (API), not yet a screen.For: Platform operator
- Security actions are written to the audit trail — Unlocking an account, removing an authenticator, setting a password, role changes, deleting, renaming and re-enabling an account, API tokens, backups, single sign-on changes and settings changes are each written to the audit trail, the most serious ones at the highest level and kept permanently. Network-rule changes are recorded at a lower level. The platform holds these entries; the company's Security log lists the account changes, while its Audit log screen does not list them yet.For: Platform operator
- Platform activity log with evidence export — Platform events carry a time, actor, company and severity, with the originating address and device where one was recorded. Operators filter by event type, severity, address or period and export the result as a JSON file for an evidence pack.For: Platform operator
- Platform events kept 180 days, nightly clean-up — A nightly job removes platform events older than 180 days, except impersonation starts, which are never removed. The period is set by the operator.For: Platform operator
- A security log written in plain sentences — Settings has a Security log of the last 90 days: who signed in, who failed to, unusual sign-ins, and who changed accounts, roles, passwords and access tokens. Every row is a sentence in the person's language with names, not a code, and each event appears once. In a company set up from now on only administrators and auditors can read it; companies set up earlier keep it with everyone who already had audit access.For: Tenant admin, Auditor
Privacy and data-protection compliance
Tools for the UAE Personal Data Protection Law (PDPL) and the Telecommunications and Digital Government Regulatory Authority (TDRA) expectations around personal data. The request and breach tools live in the HR app.
- Data subject request queue — With the HR app, HR logs access, correction, erasure, portability, objection and restriction requests, each with a due date. The compliance page lists the queue and counts open and overdue ones so none is missed. Closing a request is done through the AI Copilot or the programming interface (API); the page does not yet have a button for it.For: HR manager, Tenant admin
- A response window you can set — The due date for a data subject access request (DSAR) comes from a company setting, 30 days by default, which is the usual period under UAE and comparable laws. The number is changed through the settings programming interface (API).For: Tenant admin
- Everything held about one person in one trail — For a person making a request, HR pulls every audit entry that touched their data, across modules, as the starting point for the answer. It is available through the AI Copilot and the programming interface (API), not yet as a screen.For: HR manager, Tenant admin
- Every request step is audited — Each change to a data subject request is written to the audit trail with the legal obligation as its basis, so the handling can be shown later.For: HR manager, Auditor
- Data breach register — HR logs a breach with when it happened, how many people and what kinds of data were affected, its severity and containment notes, and the audit entry for it is kept permanently. Open and critical breaches show on the compliance page. A logged breach cannot yet be marked contained or closed, and the product does not send the regulator notice for you.For: HR manager, Tenant admin
- Expired records are destroyed on schedule — In the Documents app a nightly job destroys files whose retention period has ended and records the destruction permanently, skipping anything under legal hold. For HR employee documents the retention deadline is stamped and shown on the compliance page, but the destruction run is started by the platform team rather than on a schedule.For: Documents manager, HR manager, Tenant admin
- Legal hold — A file can be put on legal hold, which pauses its destruction until the hold is released, and HR employee documents carry the same flag.For: Documents manager, HR manager
- Retention by country — Employee document retention follows the country the person works in, for example five years for UAE and Saudi records, set by country packs rather than hard-coded.For: HR manager
- Private chat stays private, and compliance reads are recorded — Administrators cannot read other people's direct messages. A person holding the compliance-officer role can, only after typing a reason, and every such read is recorded and shown in the chat administrator's Access log, which the officer cannot open.For: Chat compliance officer, Chat administrator, Tenant admin
- Privacy and compliance command centre — One page in the HR area, linked from the Settings hub, gathers the request queue, the breach register, expiring documents, visa expiry and retention deadlines.For: HR manager, Tenant admin
- Crash reports and usage statistics from the phone app: each person chooses — The phone app can send Tarleaks crash and slow-screen reports with no name, account, IP address or anything typed, and, only with each person's own agreement, which screens they open on which day. The company has a switch for each in Settings, Mobile app, but never sees what any one person did or chose; each person can download or delete their own usage statistics. The web asks the same question once and keeps no device identifier.For: Employee, Tenant admin
Data location, backups and recovery
Where the company's data and files live, and how the company gets them back.
- See where your data lives — Settings, Data location states in plain words whether the database is hosted by us or the company's own, where files are kept, who backs up, and whether private-network addresses are allowed.For: Tenant admin
- Keep the business data in your own PostgreSQL — A company can place its business data in its own empty PostgreSQL 16 database, tested first by a seven-point check. Sign-in accounts, settings, the licence and the audit log stay with us. The move is only possible while setup is open.For: Tenant admin
- Keep files in your own storage — Files go to a bucket the company controls: Cloudflare R2, Amazon S3, another S3-compatible service, or a network storage device in its own office. Existing files stay where they are. Uploads stay off until storage is connected.For: Tenant admin
- Private network addresses need the platform's approval — A storage or database address inside a company's own network is refused until a platform operator allows it, from the request in Platform, Requests or the company's Data location dialog. Addresses that must never be used, such as the server itself, are refused even then. A company cannot grant itself a path into a network.For: Tenant admin, Platform operator
- Automatic backups to your own storage — Backups are on by default, taken daily and kept for 30 days, into the bucket the company has connected. With no storage connected there is nowhere to put them: each run is recorded as failed and the health indicator says so, instead of silently skipping.For: Tenant admin
- Back up now and download a copy — An administrator can take a backup at any moment and download it. Download is a separate permission from viewing, because a download hands over every personal record in the company.For: Tenant admin
- Files included in the backup — A setting decides whether uploaded files are backed up with the database, so the copy can restore a complete company.For: Tenant admin
- Restore with safeguards and an undo — Restoring needs its own permission and a typed confirmation of the workspace name, takes an automatic safety copy first, and can be undone. Each backup shows a compatibility verdict per app against the current software. A company on its own database restores with its own tools; the product refuses.For: Tenant admin
- Backups are recorded even when they fail — Every backup run writes a record before it starts, so a backup that stopped happening is visible rather than silently missing.For: Tenant admin, Auditor
- Operator view of every company's backups — Platform operators see backup coverage across all companies and the platform's own database, take or restore a company's backup, and see companies closed but still inside their retention period.For: Platform operator
- Close a company, keep a retention period, bring it back — Closing a company does not delete it at once. It sits in a deleted list for a retention period that operators can extend, and can be reinstated within it.For: Platform operator
- A health page for your own server — On a company's own server, Settings, System health answers in one screen: do the apps respond, is the company's database ready, is the licence serving, was a backup made, can the server send e-mail and keep files. A banner says everything is fine, that things are worth fixing, or that something needs attention, each problem names what it means for people, most link to the screen that fixes it, and Check again repeats the test.For: Tenant admin
- A getting-started list that ticks itself — On a company's own server, System health also shows a getting-started list of up to five steps: add the company details, create the departments when HR is in the plan, invite the team, set up e-mail and take the first backup. Each step ticks itself when the server finds it done, and an open step links to the screen that does it.For: Tenant admin
- Self-hosted installations with signed activation — For companies running the product on their own servers, an operator issues an activation and can suspend it for non-payment or revoke it. The installation proves itself with a signed token and every answer back is signed. There is no operator screen for this yet; it is used through the administration interface (API).For: Platform operator
- Move the whole company to your own server — An administrator makes a one-time move code, confirmed with their authenticator app, and one command on the company's own server copies everything: every app's records and files, settings, roles, record history and the audit trail, encrypted so that only that server can read it. People keep working in the cloud until the switch, then sign in with the same e-mail, password and authenticator app.For: Tenant admin
- Every table and file checked before switching — Before anything changes, the new server compares every table with the cloud by row count and checksum and every file by size and fingerprint, and shows the same key fingerprint as the cloud page so you know it is your server. Switch over then makes the cloud copy read-only and brings across only what changed since the copy, usually in a few minutes.For: Tenant admin
- A clear list of what to connect again — Passwords and keys of outside services, such as e-mail and calendar connections, social accounts, single sign-on and e-invoicing devices, are locked with Tarleaks Cloud's own keys and never leave it. The move page lists, by app and name, each one your company actually saved before you start (a key never filled in is not listed), and the report lists them again, so you type them once on the new server.For: Tenant admin
- A signed deletion certificate after the move — After the switch the cloud copy stays read-only for 30 days by default, then Tarleaks destroys the company's database and the files it stored and signs a deletion certificate. The company's own server fetches it, checks the signature and shows what was destroyed and what Tarleaks keeps by law, such as its own invoices.For: Tenant admin
Workspace setup and administration
Getting a company running, choosing its apps and keeping its settings in the hands of its own administrators.
- Sign up and start a 30-day trial — A company creates its own workspace from the sign-up page, gets its first administrator, and starts a 30-day trial with no administrator involved on our side.For: Tenant admin
- Five-step setup wizard — A new workspace opens a guided setup: company details, the apps to use, where data lives, the first branch, and the team to invite. Progress is saved, so closing the tab does not lose it.For: Tenant admin
- Add and remove apps yourself — Administrators add apps with the other apps they need, or remove them, from Settings, Apps. Removing an app keeps its data, and adding it back returns everything.For: Tenant admin
- Request apps that need approval — Apps the platform keeps behind approval are requested with a note, and the answer appears under Requests. An approved app shows up in the menu without signing out.For: Tenant admin, Platform operator
- Hide an app from the menu without removing it — Administrators tidy the menu for everyone by hiding apps nobody uses. Nothing is removed and nobody loses access; it only changes what is shown.For: Tenant admin
- Industry starting points — Choosing an industry previews, key by key, what its defaults would change, and applying them fills in only what the company has not already decided.For: Tenant admin
- Setup checklist and readiness check — A checklist lists what still has to be true before the company can run a month, and a readiness check says what would break in plain words, such as nobody can upload a document, rather than naming a setting.For: Tenant admin
- Switch optional features on or off — One page lists every module's optional features with a switch each. If the platform has turned a feature off, the page says so, and the platform setting wins over the company's.For: Tenant admin, Platform operator
- Company profile — Legal name, addresses, registration numbers, hours, localisation and compliance details are kept once on the Company page and reused on letters, payslips and invoices.For: Tenant admin
- Branding across the product — Logo, primary and secondary colours, font, text size, corner style and density are set once on the brand page, and every screen follows them in English and Arabic — buttons, badges, internal notes and AI accents included — as does the sign-in page; the logo appears on payslips.For: Tenant admin
- Branches and countries — Offices, warehouses and remote hubs are registered with country and location. In a company working in several countries, each branch follows its own country's rules.For: Tenant admin
- Company and branch holiday calendar — Public and company holidays are entered once, for the whole company or for one branch, with half-day and recurring options.For: Tenant admin
- Arabic or English as the company language — The company language setting also tells the AI features to answer in Arabic.For: Tenant admin
- Plan, seats and licence expiry at a glance — A read-only page shows the company's plan, the apps it holds, seats used against seats bought and when the licence ends. Invoice history and payment are not on it yet.For: Tenant admin
- A settings hub that shows only what you may change — The Settings page groups everything into cards and shows only the links the person has permission and licence for, so empty cards never appear. Each card needs the same permission as the page behind it, so no card leads to a page you lack the permission for.For: Tenant admin
- What's new for administrators — Company administrators get a What's new tab under Settings → Apps & features: the new features and fixes in the apps their company holds, when each went live, the page it lives on and short steps to use it. Each entry shows how it is controlled in that company — its switch, the permission it needs, which roles hold it and how many people can use it today — with buttons to turn it on and give people access.For: Tenant admin
Platform operator controls
What the people who run the service can do, and the limits and records around it.
- Authenticator required for every platform screen — A platform operator who has not set up an authenticator app is refused on every platform screen and told how to set it up, and once it is set up the sign-in itself asks for its code, so the most powerful accounts are never password-only.For: Platform operator
- Directory of all companies — Operators see every company with plan, modules, people, expiry and activity, suspend or resume one, and edit its plan and modules.For: Platform operator
- Create a company for a client — Operators create a company with its administrator and, where the client needs it, its own database address checked on creation.For: Platform operator
- Signed licences that verify offline — A company's licence is a signed token naming its plan, apps, seats and dates. Services verify it themselves without calling anyone, and a suspended or expired company is refused.For: Platform operator
- Platform kill switch for features — An operator can switch a feature off for every company during an incident or to keep it for a paid plan. The platform setting wins, and companies see the change within about two minutes.For: Platform operator
- Security signals dashboard — A dashboard shows failed sign-ins in the last hour, company-address mismatches, unfamiliar sign-ins and locked accounts, the busiest offending addresses where one was recorded, and a feed of the events behind them.For: Platform operator
- Risk score per company — Each company gets a risk score built from recent suspicious activity, so an operator knows where to look first.For: Platform operator
- Block an address platform-wide — From a security event an operator blocks the address that caused it. Platform operators are exempt and the system refuses to block the operator's own address.For: Platform operator
- Support sessions with a stated reason — An operator can open a company user's account for support only after entering a reason of at least ten characters. The session lasts 15 minutes, shows a red banner and is recorded at the highest severity.For: Platform operator
- Private chat refuses support sessions — Even during a support session, the chat app refuses to open, so an operator cannot read a person's conversations.For: Platform operator, Employee
- Per-person timeline of events — For any person an operator can open the sequence of their sign-ins and security events, which shortens the work of explaining what happened to an account.For: Platform operator
- Monitoring dashboards open behind the authenticator — Operators open the monitoring dashboards from the Monitoring page through a sign-in bridge that needs an enrolled authenticator, lasts four hours, and stops on the next request if the operator's account is deactivated.For: Platform operator
- Which companies are going quiet — A usage page lists each company's last sign-in, sign-ins over 30 days and activity this week against last week, with a high, medium or low churn-risk label, so operators know whom to call.For: Platform operator
- Decide company requests and set app availability — Operators answer requests for approval-only apps and private-network addresses, and set per app whether companies may add it themselves, must request it, or cannot see it.For: Platform operator
- Alert recipients with a real test email — Operators choose who is emailed when an alert fires, and a test send shows the mail server's actual reply for each recipient, because a green status can hide a rejected password.For: Platform operator
- Approve moves to a company's own server — Operators see every company moving to its own server: who asked, the new server's address and key fingerprint, the size and when the cloud copy is destroyed. When the operator chooses to approve every move, a company's move code works only after an operator approves it, and a refusal carries a reason the company's administrator sees.For: Platform operator
AI Copilot and access control
The AI assistant works inside the permission system; it is never a back door.
- The Copilot works with the person's own permissions — Whatever the AI Copilot reads or does, it does as the signed-in person, so it cannot show or change anything that person could not. The same tools are offered to outside agents on the same rules.For: Employee, Tenant admin
- Manage access by asking — Administrators can ask the Copilot to look at network rules, sessions, backups, roles and settings, and to add or remove network rules, take a backup or change a setting. Anything that changes data asks for confirmation first, and reading never does.For: Tenant admin
- Sensitive tools are marked as such — Tools that delete or lock things, such as removing an authenticator or revoking sessions, are flagged as destructive and need an explicit approval.For: Tenant admin
Works with other modules
Authors cannot approve their own accounting entriesA company-level switch in security settings makes Accounting refuse to let the creator of an entry, bill, expense claim or payment batch also post or approve it.Payroll preparer and approver must be different peopleThe same separation-of-duties switch makes Payroll refuse approval, payment or posting of a run or final settlement, or approval of a loan, by the person who created or requested it.A login is linked to an employee recordThe employee record holds the id of the person's login, so My team, My requests, My time and other personal screens know who is asking. It is set through the AI Copilot or the programming interface (API).Privacy requests are answered from the audit trailHR's request queue reads the audit trail kept by the security module to list everything that touched one person's data; the trail and the closing of a request are used through the AI Copilot or the programming interface (API).Security events are emailed to the person concernedLock-outs, unfamiliar sign-ins, password changes, reset requests, invitations and new API tokens each produce a branded email and in-app notice to the person's own account.Chat privacy is protected by the access rulesGrants of the permission to read all messages are recorded by security and flagged in Chat administration when self-assigned, and Chat refuses support sessions.Every record shows its history and discussionThe database change history feeds a history tab, and the Activities discussion thread sits beside it on the same record.Documents are kept in storage the company controlsThe storage location set by the administrator decides where Documents puts file contents, and backups and retention rules apply to those files.Unopened sealed bids hold back a move to your own serverWhile a tender holds sealed bids that are not opened yet, the move page names them and no move code can be made, because those bids can only be opened with Tarleaks Cloud's key.The Copilot and outside agents obey permissionsEvery tool the Copilot or an API token can call is checked against the caller's licence and permissions, and a company-wide deny list narrows it further.Marketplace apps get access only through consentAn installed marketplace app receives either a vendor-consented connection or a company token, recorded and revocable by the administrator.A branch's country decides its payroll rulesBranches registered in security settings carry a country, which Payroll reads to choose the country pack, pay groups and bank-file details for people in that branch.HR letters use the company profileCompany name, headquarters address and logo entered once in the company profile appear on letters and other documents that HR generates.Portal visitors sign in separately from staffCustomer and partner portals issue their own credential, which does not open staff screens.Attendance changes appear in the audit logThe Settings audit log reads Attendance's audit trail and shows it with the other apps' records.HR changes appear in the audit logThe Settings audit log reads HR's audit trail and its field-level change history and shows them in one list.Project changes appear in the audit logThe Settings audit log reads Project Management's audit trail and shows it with the other apps' records.Outside AI tools use access tokensAn access token created by an administrator lets an outside MCP assistant call the ERP tools it is allowed.Installs and keys are auditedEvery install, removal and token exchange is written to the audit log and platform events, and open-source installs create a key that is also listed under API tokens.Seven roles and the clearance ladderCorrespondence adds its own permissions and seven ready-made roles to the workspace's roles page; clearance for each classification level is an ordinary permission.
Done by more than one person
A new colleague is invited and signs inA locked-out colleague is unlocked by an administratorA lost phone is replaced with a new authenticatorResponding to a suspicious sign-inA custom role is created and given to a colleaguePreparer and approver must be different peopleRestricting sign-in to office networks, safelyA company asks for an app that needs approvalAllowing storage or a database inside the company networkA platform operator helps a user with their account openAn employee asks for a copy of their personal dataSomeone is made a compliance officer and reads a private conversation
What each role gets
- Tenant admin — Decides who can get in and what they can do — adds people with their roles or invites the whole team during setup, tailors the forty-plus built-in roles or builds custom ones from permissions grouped by module, and retires roles without losing history. Reads each person's security posture on the Users list (last sign-in, authenticators, passkeys, live sessions, lock state), sees where an account is signed in and signs a person out of every device within seconds, limits sign-in to the office networks, and finds every security action in the audit trail. Adds the outside apps staff sign in to with their workspace account, and makes a new secret for one at once if it leaks. Connects the company's identity system — Microsoft Entra ID, another OpenID Connect provider or SAML — in Settings → Single sign-on, tests it, maps directory groups and app roles to roles, and lets Entra create and switch off accounts by itself.
- Every user — Signs in at the company's own address and stays signed in for up to 30 days without retyping the password, and signs in to the outside apps the administrator added with the same account. Changes their own password from My profile — which signs out every other device and sends a notice — sees there which roles they hold, and gets an email when a sign-in comes from an unfamiliar network or browser. Completing a password reset ends every other session at once, so a hijacked session is lost, and signing out also ends the access of the outside apps that sign-in approved. Where the company has connected its identity system, signs in with Sign in with Microsoft or the company's single sign-on button instead of a password.
Frequently asked questions
Is our company's data kept separate from other companies on the same system?
Yes. Every company has its own database rather than rows in shared tables, and every request is also checked against the company address it came from. A valid login used on another company's address is refused.
Can we keep our data in our own country or on our own server?
Partly. Files can go to a storage bucket or office storage device you control, and business data can be placed in your own PostgreSQL 16 database, but only while workspace setup is open. Sign-in accounts, settings, the licence and the audit trail stay on our servers. Existing files are not moved when you change storage later.
Does it support two-factor authentication and single sign-on?
Yes. Anyone can set up an authenticator app with backup codes, and from then on every password sign-in asks for its code; platform operators must have one. Staff can sign in to outside services with their workspace account: an administrator adds each app in Settings. People can also sign in to the workspace with your own identity system — Microsoft Entra ID, another OpenID Connect provider or SAML 2.0 — which the administrator connects and tests in Settings → Single sign-on; at single sign-on your provider's own second step counts, and you can make it mandatory. Passkeys are not offered yet.
Does it work with Microsoft Entra ID (Azure AD)?
Yes. The administrator enters the directory ID or a verified domain and the application ID in Settings → Single sign-on, chooses a client secret or a generated certificate, pastes the values the page shows into Entra and runs a test sign-in. Entra groups or app roles can give workspace roles, and Entra's automatic provisioning (SCIM) can create, update and switch off accounts. It covers sign-in, roles and accounts; Outlook calendar, Teams and OneDrive are not connected.
Can our staff use their workspace account to sign in to other tools?
Yes, for any outside service that supports OpenID Connect single sign-on. An administrator adds the service in Settings → Security & audit → Sign in to other apps and copies three values into it. People come back signed in with their email and name, nobody keeps a second password, and the service loses access when the sign-in that approved it ends (the person signs out or the session is ended), when the person's password changes or their account is disabled or archived, or when the workspace is suspended.
Can I restrict who sees what, for example managers only in their own department?
Yes. Permissions are fine-grained (well over a thousand), more than forty ready-made roles are included, you can edit them or build your own, and managers see only the departments they manage by default. Screens hide what a person may not use, and the server refuses it as well. A tenant administrator holds the accounting and payroll permissions too, so turn on the separation-of-duties switch if the same person must not prepare and approve.
Is there an audit trail, and can it be made tamper-evident?
Yes. Audit entries record who, what, why and the legal basis, and a separate change history records old and new values, shown on the Audit log screen and on each record. You can switch on a tamper-evident chain where each entry fingerprints the one before it; the chain check is currently run by platform operators through the administration interface. Entries for user, role and token administration are kept by the platform and are not yet listed on the Audit log screen.
How does it help with the UAE Personal Data Protection Law (PDPL)?
With the HR app, HR gets a queue for access, correction, erasure, portability, objection and restriction requests with due dates, a breach register, a per-person data trail, retention deadlines and permanent records of destruction in the Documents app, with legal hold. It supports the process; it does not replace legal advice or make a company compliant by itself.
Can the vendor's staff see our data?
Platform operators can open a user's account for support, but only with an enrolled authenticator, a typed reason of at least ten characters, a 15-minute limit and a red banner, and every session is recorded. Chat refuses these sessions, so private conversations stay private. Files you keep in your own storage are not stored by us.
Can we limit sign-in to our office networks?
Yes, as an optional feature. You list allowed address ranges and the system adds your own address and refuses settings that would lock you out. Turning it on needs the platform's network front to confirm your address, and the screen tells you when it cannot. A platform operator can switch the list off if the company is locked out. You can also block single addresses.
What happens if we lose data or need to roll back?
Backups run daily by default and are kept for 30 days, into your own storage once it is connected; without storage each run is recorded as failed. You can back up on demand, download a copy and restore with a typed confirmation, an automatic safety copy and an undo. A company on its own database restores it with its own tools.
Part of one platform
Security, Access & Compliance is part of the platform itself, not a separate app: every workspace has it, and it works across all 59 apps with the same sign-in, people and customers. See all apps or how Tarleaks ERP compares with Odoo, ERPNext and Zoho.
Guides for Security, Access & Compliance
Secure and Organised: Where Your Data Lives Sets Its Value
How to keep business data secure and organised in the UAE and Saudi Arabia: where the rules say it lives, one record per customer, and a ten-question check.
Saudi PDPL Draft Rules: In-Kingdom Storage and What to Map
What SDAIA's draft changes to the Saudi PDPL Implementing Regulation say on in-Kingdom storage, breach notices and registration, and what to map now.
Why Rust: Tarleaks ERP Architecture for Gulf Tenders
Why Tarleaks ERP is written in Rust, how one database per company and a full audit trail work, and how the design answers NCA ECC, UAE IA and PDPL questions.
One Database per Company vs a Shared Database in ERP
A shared ERP database separates companies by a filter; a database per company by the connection. What it changes for backups, restore and exit.