Data security

The database checks every row before it is read or changed (row level security). A row is visible only to members of the business that owns it, according to their role. This separation is tested automatically on every database change, including attempts to read another business's data.

Staff only see their own data: their attendance, leave, and payslips. Accountants can view and export, but cannot approve payroll or suggestions.

The database and files are stored in a data center in Singapore. Every API accepts HTTPS connections only (TLS 1.2 or 1.3).

Secret keys (AI keys, notification keys) are kept encrypted in the database vault or as server secrets. They never sit on a phone, in the browser, or in the code.

AI reads files and prepares suggestions. New data is recorded after the owner or an admin approves. Payroll, settling invoices, and changes to people's records always go through a human button.

Only rules the owner sets up run automatically, such as sick leave up to a certain number of days. Every automatic decision is logged with its reason and can be undone. AI output is treated as untrusted input: AI cannot hide anything from the owner or delete data.

ID numbers (NIK) are not stored in full: only a random fingerprint and the last 4 digits. Bank account numbers and ID numbers are compared by fingerprint to find duplicates in the Payroll Gate, without revealing the real values.

Mata and interview transcripts run on the user's phone or laptop. CCTV is read through a bridge on the shop computer, so the video never leaves the shop network. Only hourly summaries are sent: visit counts and minutes per zone.

For a new camera, the owner can ask for a layout suggestion. One frame is shrunk to 320 pixels and blurred on the device, then read once by AI. That frame is not stored.

A staff PIN locks for 15 minutes after 5 wrong tries. The attendance QR code changes every 15 seconds and can be used only once per person for the same kind of check-in.

Payslip and attendance tablet links carry a token in the part of the URL that is never sent to the server. The token expires and can be revoked. An AI assistant you connect through MCP gets access to one business only and can be disconnected at any time.

There has been no outside security audit and no certification yet. Weekly backups to separate storage are being built. An official address for reporting security issues is being set up.