Security

Built for data you can't be casual with

Employee records, attendance, and personal identifiers deserve the same rigor as payroll. Here's what that actually means in Caosira, not a badge, an architecture.

Audit log

Every change, attributed, permanent

Field-level changes to employee records are logged with who made the change, when, and the before/after value. Admins and HR see it org-wide; nothing gets quietly edited.

Audit log

Priya Sharma2m ago

phone: 555-123-4567 → 555-999-8888

Jane Doe1h ago

department: Sales → Customer Success

Priya Sharma3h ago

employment_status: active → on_leave

PI vault

National ID

•••• •••• 4821Reveal

Bank account

•••• •••• •• 0173Reveal

Visible only to admin/HR and the employee themselves.

Sensitive fields, kept separate

National IDs and bank details aren't just another column

Identity and bank fields live in a separate table, masked by default, restricted to admin/HR and the employee themselves, with the same row-level isolation as every other table. API keys work the same way: hashed server-side, shown once at creation, instantly revocable.

How it's built

Principles, not a compliance badge

Caosira is early-stage and hasn't pursued formal certifications like SOC 2 yet. Here's what's actually built into the architecture today.

Data isolation by default

Every organization's data is scoped at the database level with row-level security, not just filtered by app logic. One org can never query another's rows.

Module-level permissions

Grant an employee access to just one module, like recruitment or assets, without making them a full admin. Least privilege, not all-or-nothing.

Real biometric verification

Optional clock-in verification uses WebAuthn platform authenticators (Face ID, Touch ID, Windows Hello): a genuine cryptographic assertion, verified server-side, not a stub.

Rate limiting on public endpoints

The career-page application form and the public API are both rate-limited per IP or per key to deter abuse.

Private document storage

Employee documents, resumes, and company files live in private storage with per-file visibility, not a shared public bucket.

Scanner-safe auth flows

Signup, invite, and password-reset links require an explicit click to confirm, so automated email/link scanners can't silently consume a one-time token.

Read the full privacy policy

What we collect, who processes it (Supabase, Resend, Vercel), and how long we keep it, in plain language.

View privacy policy

Have a security questionnaire to send us?

Happy to walk your security or IT team through the architecture directly.

Talk to us