Governance you can hand to the auditor.
Read-only access. Versioned rules. Every change carries an actor, a timestamp and an IP — no CSV dumps, no spreadsheets, no surprises.
RBAC · employee scope
Recent audit
- RP10:18
Updated payroll lock
Reema Patel · 10.4.21.6
- DC09:41
Granted Auditor role
Diego Cruz · 10.4.21.18
- AL09:02
Exported headcount
Ana López · 10.4.21.41
100%
Audit-trailed
SOC 2
Ready
Most HR systems weren't built to be audited.
Three patterns repeat across every people platform. They're invisible until the auditor walks in — or the regulator does.
No trail
Salaries change. Roles flip. Records are edited. Auditors find it weeks later — if at all.
Everyone is admin
RBAC is a tab nobody opens. Manager dashboards leak comp data. Permissions sprawl quietly.
CSV-as-audit
Auditors get a spreadsheet dump every quarter. Versioning lives in filenames. Trust erodes.
Roles. Capabilities. Scopes.
Permissions modelled per capability bundle, not per page. Scoped roles pin access to direct reports, business units or time windows.
HR Admin
Owns lifecycle & policies
Manager
Direct reports only
Finance
Comp & payroll bundle
Auditor
Read-only · time-boxed
Every change. Replayable.
Audit events carry actor, IP, timestamp and before/after diffs. Filterable, searchable, exportable — and pinned to the rule version that was live.
Before
Carry-forward 5 days
After
Carry-forward 7 days
N-step approvals. Versioned. SLA-bounded.
Approvals modelled per policy, with versioned chains, role fallbacks and SLA breaches surfaced before they cost the business.
Salary change > 10%
Trigger · Comp edit
Leave request > 5 days
Trigger · Self-service
Expense > $1,000
Trigger · Submitted
RBAC grant · external
Trigger · Role change
Where the record lives. Who holds the key.
Choose the region. Bring your own key. Keep PII inside the border. People honors residency, sovereignty and key-management without separate SKUs.
India
- ap-south-1
- AES-256 · CMEK
- DPDP
Europe
- eu-central-1
- AES-256 · BYOK
- GDPR · Schrems II
United States
- us-east-1
- AES-256 · CMEK
- SOC 2 · CCPA
Singapore
- ap-southeast-1
- AES-256 · CMEK
- PDPA
UAE
- me-central-1
- AES-256 · BYOK
- PDPL
Governance shouldn't bill per audit. It belongs in the platform.
Most platforms put audit logs, advanced RBAC and data residency on a higher tier. People treats governance as a product primitive — included in every operator seat.
Trust starts with a trail. People builds it.
RBAC, audit, approvals and residency — every governance lever in one platform, in every plan, on every operator seat.
- Audit-trailed
- Read-only export
- SOC 2 ready