PrimeForce / Security
Authorization that fails closed.
Payroll data is salary data, CNICs and bank accounts. This page states what the product enforces today, and the three capabilities still in development. Anything beyond that we will answer in writing, under NDA.
Access control at a glance
256 permissions, four checks deep
Permissions read Module.SubModule.Verb. After the permission check, three more filters run: is this sub-module in the company’s plan, is this the caller’s own record, and does the payload validate.
Unguarded endpoints are denied
An endpoint nobody remembered to annotate returns 403 and logs a misconfiguration warning. Forgetting to guard something denies access instead of granting it.
Verified at every boot
Startup scans every action for unguarded employee parameters and logs each as a security error, then pushes any newly added permission to every existing company administrator.
Row-level security in the database
SQL Server row-level security with filter and block predicates on 23 leave and payroll-run tables, evaluated against the session's company — below the application, not inside it.
An audit log that can't be rolled back
Audit rows are written on their own transaction, so a failure in the audit sink can never roll back the operation it was recording. Blocked actions leave a row too.
Sessions you can see and revoke
Access tokens last 15 minutes and refresh rotates. Each device holds its own session, listed and individually revocable. Accounts lock after five failed sign-ins.
What is enforced.
| Control | Implementation |
|---|---|
| Authentication | JWT bearer (HMAC-SHA256). Sign-in takes Company Code, username and password — usernames are unique per company, not globally. |
| Session lifetime | Access token 15 minutes. Refresh token 1 day, and it rotates on every use. |
| Concurrent sessions | Each device holds its own session record and its own hashed refresh token, so signing in on a phone does not sign you out on a laptop. |
| Session control | Active sessions are listed and individually revocable. An administrator password reset revokes every session of that user. |
| Token storage | Browser: session storage, cleared when the tab closes — deliberately, so a shared machine does not keep a session. Android: platform preference storage, so the session survives the app being killed. |
| Passwords | BCrypt, cost factor 12. Minimum eight characters with upper, lower, digit and symbol. Accounts lock after five failed attempts. |
| Forced password change | Enforced on three independent layers: a token claim, server middleware with an allow-list, and two client route guards. |
| Authorisation | 256 permissions as Module.SubModule.Verb, enforced by a global filter that fails closed — an endpoint nobody annotated is denied, not allowed. |
| Plan entitlement | A second filter checks the sub-module is in the company’s plan, independently of whether the user has permission. |
| Record ownership | A third filter confirms self-service callers only reach their own employee record. A null employee identity fails closed. |
| Row-level security | SQL Server RLS with filter and block predicates on 23 leave and payroll-run tables, evaluated against the session’s company. |
| Audit log | One row per audited action with company, acting company, user, action, module, table, record, old and new values, IP and timestamp. Written on its own transaction so it cannot be rolled back with the operation it recorded. Blocked actions are logged too. |
| Client IP | Real client IP is recovered from the edge proxy headers, so the audit trail records the user, not the CDN. |
| Encryption in transit | HTTPS only, terminated at the edge. |
| Encryption at rest | SAP Business One credentials are encrypted with AES-256 via the platform data-protection key ring. Passwords are BCrypt hashes. |
| Payslip protection | Payslip PDFs can be password-protected; the default password method is the employee’s CNIC. |
| ERP safety interlock | SAP posting is gated on the connected database name matching a configured value. A restored copy of production refuses to start rather than posting to a live ERP. |
Three things we don't do yet.
Worth knowing before you get to a security review rather than after.
| Capability | Status |
|---|---|
| Multi-factor authentication | Not in the product today. Sign-in is username and password against your company code. |
| Single sign-on | Not in the product today. No SAML or OIDC provider integration yet. |
| Email notifications | Not in the product today. Notifications are in-app, and password resets are administrator-initiated rather than self-service. |
Running a formal security review? Send us your questionnaire and we will answer it in full, in writing, under NDA — including the controls not described on this page.
Send us your security questionnaire.
We would rather answer it before you buy than after.