Security controls shown as layers.
Security content in 1nHR separates current controls, review gates, roadmap items, and service targets so trust never reads like a vague promise.
Isolation model
Route membership
Users enter tenant-scoped routes only through verified membership context.
Object authorization
Sensitive objects are checked by role, ownership, workflow state, and tenant boundary.
Tenant repositories
Data access paths are tenant-scoped before records reach application surfaces.
Postgres RLS
Database policies provide a final boundary for tenant and role separation.
Trust controls are operational, not decorative.
Security is expressed as what is isolated, what is approved, what is logged, and what is gated before broad rollout.
Tenant boundary
Route membership, object authorization, tenant-filtered repositories, and PostgreSQL RLS form layered isolation.
Sensitive workflows
Payroll, statutory changes, exports, owner changes, and administrative actions use stronger review paths.
Audit posture
Security events, access changes, payroll release points, exports, and policy edits stay reviewable.
Access hygiene
Session rotation, MFA readiness, restricted scopes, and least-privilege defaults reduce standing risk.
Security is part of the workflow.
The strongest controls are designed into daily HR operations instead of sitting beside them as policy text.
Authenticate
Short-lived sessions, secure cookies, rotating refresh-token families, and privileged role checks.
Authorize
Object-level access checks and tenant-aware repositories protect payroll, people, and compliance records.
Approve
Sensitive workflow changes are surfaced for maker-checker review before they affect outputs.
Audit
Security events, exports, payroll releases, and policy edits produce evidence for later review.