How to Choose HR and Payroll Software in the UAE
Fifteen questions to ask any HR and payroll software vendor in the UAE: a real WPS file, gratuity on your contracts, Arabic screens, data location and exit.
For IT and security teams
Decide who can do what, and see that it holds
Permissions by action, a separate database for each company, sessions you can end in seconds, and an audit trail with before and after values.
No credit card · Ready in about a minute · Your data stays private
What you get
The controls IT and security teams ask about first. Each links to the full feature list.
Permissions, not job titles
Every action is its own permission, bundled into more than forty ready-made roles that each company can edit.
A separate database for each company
Each company's business records live in their own database, not in shared tables with a company label.
Sessions you can end in seconds
Signing someone out, resetting a password or archiving a person cuts access within seconds, and five wrong passwords lock the account.
Audit trail with before and after
The database records the old and new value of every tracked change, and one audit screen exports it for the audit pack.
Your storage, your backups
Files go to a bucket you control, and daily backups land there too, kept for 30 days.
Outside access under control
API tokens with a scope, expiry and rate limit, and a deny list that switches apps or single tools off for outside AI.
Your week in Tarleaks
Five administration tasks, linked to guide steps where a guide exists.
| Task | How often | Step by step |
|---|---|---|
| Decide who approves which request | When teams change | Decide who approves which requestAdministrator guide to HR, step 2 |
| Choose the AI provider and model | Once, then on review | Choose the provider and the modelAdministrator guide to the AI Copilot, step 1 |
| Read who can see which documents | Monthly | Read who can see whatAdministrator guide to documents, step 2 |
| Check the country rulebook | Yearly | Check the country rulebookAdministrator guide to accounting, step 2 |
| Sign a leaver out of every device | When someone leaves | SecurityStep-by-step guide coming |
Apps you will use
Security and access are part of every workspace; these apps hold the settings you will touch.
Security, Access & Compliance
Sign-in, sessions, roles, audit trail, data location and backups.
AI Copilot
Your AI provider, key and models, and what the assistant may do.
Document Management
Access by person, team or role, with a reason for every grant.
What everyone else sees
Access is decided on the server; the screens mirror it.
- Each person sees the roles they hold and how many permissions those add up to. Security
- Screens hide what a person may not use, and the server refuses it anyway. Security
- Employees reach their own profile, time, requests and payslips, and nothing about colleagues. Security
- The AI Copilot works with each person's own permissions. Security
Guides
Plain-language guides from our blog, with their official sources, and step-by-step guides for each role.
Step-by-step role guides
Questions
Where is our data kept?
Settings, Data location says it in plain words. Your business data can stay in your own PostgreSQL database and your files in your own storage bucket; sign-in accounts, settings, the licence and the audit log stay with the platform.
Does Tarleaks support single sign-on?
Yes. An administrator connects Microsoft Entra ID, any other OpenID Connect provider or SAML 2.0 in Settings, Single sign-on, runs a test sign-in, and maps directory groups to roles; the directory can also create and switch off accounts by itself (SCIM). Single sign-on still honours your network access rules and account locks.
Is a second factor required for staff?
Not yet. Anyone can enrol an authenticator app with backup codes, but today the code is asked only of platform operators. Account lock after five wrong passwords and instant sign-out apply to everyone.
Can outside tools use our data?
Only through API tokens you create, each with a scope, an optional expiry and rate limit. A company-wide deny list switches off whole apps or single tools for every outside agent.
Not covered yet
- Authenticator codes at staff sign-in: enrolment exists, but the code is required for platform operators only.
- A complete single sign-on connection without custom work on the return step.
- Security administration entries (users, roles, tokens, network rules) are not on the audit log screen yet.
Bring your security questions
Tell us what your security review asks, and we will show you the answer in the product.
No credit card · Ready in about a minute · Your data stays private
Free for 30 daysNo credit cardStart free trial