Everything about a person hangs off one employee record. Understanding how it is split explains who can see what, and why some fields are read-only to the person they describe.
Identity Is The Employee Record
The employee record is the identity the platform uses everywhere - deal owners, approvers, task assignees, document signatories. Not the login account. That distinction matters because someone can exist as an employee before they ever sign in, and a login without an employee record cannot be assigned work.
The Core Record
Name, employee code, email, hub, department, designation, manager, joining date, probation end date, employment type, and status.
Status is one of:
| Status | Means |
|---|---|
| Probation | Employed, inside the probation period |
| Active | Employed, past probation |
| Terminated | No longer employed |
Work location is office, remote or hybrid.
Employee codes are issued per hub from a format you control - see Invoice and Employee Numbering in the Operations section.
The Sensitive Parts, Kept Separate
Personal and compliance data live in their own tables, and much of it is encrypted at rest:
- Compliance profile - date of birth, gender, nationality, marital status, passport number and expiry, national ID and expiry, country of residence. The identifiers and dates of birth are stored encrypted.
- Dependants - names, dates of birth, relationship, and whether they need insurance cover. Names and dates of birth encrypted.
- Compensation - salary, currency, breakdown and bank details. Bank details encrypted, with a key version recorded.
- Employee details - bank account and emergency contact, both encrypted.
Keep in mind
This split is deliberate. Someone who can see the directory sees names and departments; seeing a passport number or a salary is a separate permission. If you are designing roles, that is the line to think about. See Permissions in the Settings section.
Documents
Documents attach to the record with a category, a type, an expiry date and a verified flag.
The expiry date earns its keep. Passports, visas and work permits expire, and an expired document is usually a compliance problem before it is an HR one. Record expiries when you file the document, not when someone asks.
Compensation History
Compensation is dated. Each change is a new record with an effective date, and the previous one is retained - so you can answer what someone was paid in a given month without reconstructing it. Payroll reads the record effective for the period.
Change Requests
Some changes go through a request rather than a direct edit. A change request carries the type, the proposed data, a status, who asked and who approved, plus comments.
This is what keeps an audit trail on the fields that matter. A salary or a job title changing with no record of who approved it is a problem in any organisation large enough to have an HR function.
What The Person Can Change Themselves
Their own name, photo, timezone, working hours, notification preferences and theme - in their account settings.
Not their designation, department, hub, reporting manager, joining date or employee code. Those are read-only to them because payroll, compliance and the org chart read them. Their profile shows the values with a pointer to ask HR.
See Your First Hour in the Getting Started section.
Common Questions
Someone exists twice. Usually one record created by an import and one by an invite. Merge before anything is assigned to either, because history follows the record.
Can we delete an employee? Records are archived rather than removed - attendance, payslips and approvals reference them. A leaver becomes terminated and is settled. See Final Settlement.
Who can see salary? Only roles granted it. It is a separate capability from seeing the employee record.
Why can I not edit my own department? Because payroll, approval routing and the org chart read it. Ask HR, and the change is recorded.
Did this answer your question?
No, ask a person