Security
Security is built into every layer: tenant isolation, permissions, encryption and audit.
Tenant isolation
Every record belongs to one company and every query is scoped on the server. A company id sent by a browser or app is never trusted.
Access control
Roles and granular permissions are checked on the server for every action — hiding a button is never the only protection.
Encryption
Passwords are hashed with bcrypt, API tokens are stored only as hashes, and bank account, PAN and document numbers are encrypted.
Biometrics and location
Face lock stores an encrypted numeric face signature only — never a photo. Location is captured only at check-in.
Audit
Sensitive actions — payroll lock and reversal, corrections, exports, permission changes — are written to an immutable audit log.
Put next week's roster on Work Nexa
Import your people, set your shift patterns and run a parallel payroll before you switch. Most teams are live within two weeks.