Built for the data HR systems actually hold

Multi-tenant isolation

Every employee, leave request, attendance record, and audit row is scoped to a company id. The application code refuses to query without that scope, and every server action resolves the caller's company before it touches the database.

Role-based access control

OpenHR ships with 30+ granular permissions covering view, edit, approve, and admin actions across every module. Permissions are checked at the server action layer (not just the UI) so a compromised browser session cannot bypass them.

Audit logging

Sensitive employee changes — role updates, salary edits, document uploads, leave approvals, biometric mappings — are written to an immutable audit table with actor, action, before, and after states. Audit rows are company-scoped like everything else.

Encryption at rest for sensitive credentials

Biometric device API keys are encrypted with AES-256-GCM before they touch the database. The encryption key is environment-supplied, not embedded in the codebase.

Authentication and 2FA

Authentication runs on NextAuth.js v5 with hardened credentials and Google OAuth providers. Two-factor authentication is available via TOTP or email verification.

Self-hostable

OpenHR is designed to be deployed on your own infrastructure. Your data never leaves your servers and you control the upgrade cadence.

This page is a current snapshot of platform-level controls. For specific certification questions (SOC 2, ISO 27001, GDPR DPA), please contact support — formal attestations may be in progress and we will not claim them here until they're complete.