Radu, IT security reviewer^*

Three shapes: shared SaaS on infrastructure we operate, dedicated SaaS reserved for your organisation, or your own infrastructure, self-hosted on Kubernetes. Shared hosting is included in the software licence; dedicated hosting is priced separately and is required for bespoke code outside the standard supported release or requested isolation. Changes included in the standard supported release do not themselves trigger dedicated hosting. Standard product releases use the same codebase across these shapes. Customer-specific code has a separately agreed release and maintenance scope.

Yes. Every tenant gets its own identity realm (Keycloak) and, per our infrastructure practice, its own separate database. A query cannot cross tenant boundaries by accident, because there is no shared table it could cross. This is true whether you're on our shared cluster or a dedicated one.

Yes: Microsoft Entra ID (Azure AD) through Keycloak's OIDC federation, or an on-premises Active Directory through LDAP, with optional Kerberos for a passwordless internal login. Your staff sign in with the credentials they already have; you keep control of the account lifecycle.

New starters, yes: a scheduled job reads your Active Directory over LDAP and creates or updates the matching employee record automatically. Leavers, no, not yet: the sync creates and updates, it does not deactivate someone who has left your directory. Removing an ex-employee's access is still a manual step today.

Permissions are scoped on a six-level ladder, from your own record up to the whole organisation, applied independently to read and write, for every one of 17 securable areas, down to individual business actions such as approve a swap versus delete a leave request. Write access can never exceed read access for the same role.

Protected endpoints and handlers check operation privileges, and secured repositories apply employee and unit scopes. Coverage differs between persistence paths. Include direct API and target-record authorization tests for the workflows and roles in your deployment.

Supported uploaded-document storage encrypts file content. Key management and legacy-file coverage must be reviewed for the deployment. General employee responses separate confidential fields; history and exports have additional access paths and must be included in the permissions review.

Audit & History provides actor, time and before/after values for supported recorded changes. Confirm the implemented coverage, permitted viewers, retention and any export requirement in the written offer. It is not an exhaustive or tamper-proof record of every action.

The gateway strips the external caller's internal-call marker. User-facing calls propagate a security context, while background jobs and message consumers have service contexts. Review those privileges and the deployed network boundary together.

Request the current assessment scope, tested version, open findings, remediation evidence and regression coverage during evaluation. This page does not establish that every finding is closed or that every deployment has the same tested controls.

When an engagement ends we can deprovision your tenant: its identity realm removed, its database dropped, its stored secrets revoked. It is a documented step in how we retire a tenant, not an afterthought we improvise on request.