Security you can check

• Named permissions for every action, grouped into ready-made roles you can copy and change.
• Department scope: a manager sees their own departments unless you grant more.
• A personal-data audit log with legal basis, purpose and retention, and an optional tamper-evident chain.
• Field-level history on tracked records: the old value, the new value, who changed it and when.
• Instant sign-out: ending a session or resetting a password stops access straight away.

• Your company chooses the provider. Use your own key, or run models on your own servers (for example Ollama or LM Studio).
• The question and the data needed to answer it go to the provider you chose, and to no one else.
• The Copilot sees only what the signed-in person may see, and asks before it changes anything.
• AI output is advisory: data extracted from documents is marked for a person to check.

• Memory-safe by design: Rust rules out whole classes of memory bugs (buffer overflows, use after free) before the program runs, and our rules refuse unsafe code unless a reviewed exception says why.
• No garbage collector: Rust compiles to native machine code that frees memory as it goes, so there are no garbage-collection pauses.
• Each app is its own service: HR, payroll, accounting and the rest each run in their own service with their own data schema, so a heavy job in one app runs apart from the others.
• Libraries checked every day: every build pins its library versions, each change to our libraries is checked against known security advisories before it is merged, and a daily scan alerts us to any new one.

Tell us through the contact form with the topic "Security question", and include the steps to reproduce it. Please do not test against other customers' data.