GDPR by design
Data-subject rights, lawful processing and consent tracking are built into the platform — not bolted on.
EU hosting & residency
Your data is hosted in the EU, with data-residency options available for Enterprise.
Role-based access
Granular RBAC ensures every person sees only the data their role permits — across every module.
Field-level redaction
Sensitive fields can be masked per role, so directory and reports never over-expose personal data.
Full audit trails
Documents, requests and approvals are logged end-to-end for a complete, defensible record.
Retention & anonymisation
Configurable retention and anonymisation policies keep you compliant as people join and leave.
Encryption
Data is encrypted in transit and at rest, following modern security best practices.
Consent & e-signature
Capture and store consents and signatures with a verifiable trail, filed automatically.
Ready for your security review
We're happy to complete vendor questionnaires, provide a DPA and walk your IT and legal teams through our controls during evaluation.