Security
Your records, locked to your company.
HR records are the most sensitive thing a business keeps. Here’s exactly how HR PaperTrail keeps yours separate, permissioned, on the record — and out of the wrong hands.
Organization › Roles & Access
Access Matrix
| Permission | System Admin | HR | Dept. Manager | Shift Lead | Employee |
|---|---|---|---|---|---|
| See every employee in the company | |||||
| See employees in managed departments only | |||||
| Open their own employee record | |||||
| View any counseling record | |||||
| See incident entries marked private | |||||
| View employee risk insights | |||||
| See repair cost figures | |||||
| Report a repair | |||||
| Create, edit and delete roles |
Locked: a change that would let you raise your own access.
Your own workspace
Your own address. Your own walls.
Every company runs on its own subdomain, and every query is scoped to that company. Another company’s data isn’t hidden behind a filter on your screen — it’s never in the query.
- yourcompany.hrpapertrail.com, with your logo on your sign-in page
- Records scoped to your company on every request
- Requests for another company’s records are redirected or refused
- Sessions tied to your own address
- Each company sets its own roles and permissions
Another company
••••••.hrpapertrail.com
Redwood Crown Card Club
redwoodcrown.hrpapertrail.com
- Employees
- Write-ups
- Incidents
- Requirements
- Files
- Repairs
Demo company · fictional
Another company
••••••.hrpapertrail.com
Access control
Everyone sees exactly what they should.
A shift lead sees their crew. HR sees everything. Someone who works in HR doesn’t have to see their own file. You decide, on one grid — pick a role to see it from their side.
Viewing as Human Resources
8 of 8 departments
- Casino (visible)
- Security and Surveillance (visible)
- Finance (visible)
- Kitchen (visible)
- Bar (visible)
- Service (visible)
- Facilities (visible)
- Administration (visible)
Can see
- Employee files (visible)
- Counselings (visible)
- Incidents (visible)
- Private entries (visible)
- Risk insights (visible)
- Repair costs (visible)
- Their own file (hidden)
Danielle sees every department, private entries and risk insights. Here her company has also hidden her own file from her: switch off one permission and HR staff can’t open their own record, or anything written about them.
Default grants for the built-in roles. Every company can change them, or build its own roles.
-
90+ plain-English permissions
Every role on one Access Matrix. Toggle a cell or a whole domain, then save or discard.
-
Custom roles
Start from a template, clone a role, compare any two side by side, reset to default.
-
Department-scoped managers
Department Managers and Shift Leads see the departments they manage — nothing else.
-
Private incidents and notes
Sensitive entries are visible only to the roles you choose.
-
Hidden own records
Hide a person’s own file — and everything written about them — from their own login.
Audit history
A paper trail for the paper trail.
When a decision gets challenged months later, “who changed this?” has an answer.
- Change history on 53 record types: who, when, from where, old and new values
- No history limit — nothing ages out
- Repair tickets keep a permanent activity log
- Role and permission changes are recorded
- Support impersonation is logged
Change history · redwoodcrown
On file-
10:16 AM
Danielle Okafor updated Counseling · Written Warning · Marcus Bell
status: Pending signatures Signed
-
10:03 AM
Danielle Okafor updated Requirement · Key Employee License · Tommy Nguyen
proof: — license-renewal.pdf
-
09:47 AM
Sam Ortiz updated Role · Shift Lead
permission: — See repair cost figures
-
01:52 AM
Jake Holloway updated Repair ticket · RM-0015 · PTZ camera 14
status: New Assigned
-
09:41 PM
HR PaperTrail AI updated Incident · Patron altercation — Table 7
workplace violence: Not reviewed Detected · 94%
Illustrative entries from our fictional demo property.
Files
Files that stay where they belong.
Signed write-ups, incident video, license photos. Every upload is checked at the door and stored privately — never at a public address.
- Private storage
- Files live in private storage under your company’s own path and open through short-lived signed links.
- An allow-list
- Only expected document, photo, audio and video types get in — 43 dangerous extensions are refused outright.
- Real content checks
- A file’s actual contents must match its extension. Double extensions are refused.
- Staging stays private
- Uploads in progress are never web-served, and are cleaned up once the record is saved.
Upload check
- written-warning-marcus-bell.pdf Stored privately Stored
- table-7-footage.mp4 Stored privately Stored
- guard-card-renewal.heic Stored privately Stored
- receipt.pdf.exe Double extension — blocked Blocked
- shift-notes.php Dangerous file type — blocked Blocked
- walk-in-photo.jpg Content doesn’t match — blocked Blocked
1.5 GB
max per file
43
types refused
Signed
short-lived links
Accounts
When someone leaves, so does their access.
The controls you reach for on a bad day — one click, effective immediately.
Disable a login instantly
A disabled user is locked out everywhere on their next request — and their API tokens stop working.
Force a password reset
Ends their sessions, rotates the remember token, revokes API tokens and sign-in links, and blocks reuse of the old password.
Sign-in links that expire
Secure sign-in links can expire, can be single-use, and every click is logged.
No self-escalation
Nobody can grant a role they don’t fully hold, or edit their own roles, employee link or departments.
API tokens you control
Optional expiry dates, last-used times, who created each token, and one-click revoke.
Impersonation, logged
When support signs in as a user to help, it’s logged and an on-screen banner says so.
AI and your data
AI that reads. People decide.
HR PaperTrail’s AI features are decision support. Here’s what they read, and who processes it.
AI subprocessor
AI features are processed by OpenAI through its API. The data listed here is sent to OpenAI when a feature runs — incident narratives included.
- It never issues discipline or approves anything on its own
- A manager approves every suggested point adjustment
- Workplace-violence reasoning is saved with the record for review
- Your team decides what a flag means
- Incident narratives and details
- Flag incidents that may meet California’s §6401.9 workplace-violence definition, and suggest point adjustments from your own infraction list.
- 12 months of an employee’s records
- Points, counselings, incidents, PIPs and employment events, summarized into a risk level, a 0–100 score and the concerns behind it.
- Photos you choose to submit
- Identify equipment from a nameplate, read a receipt, or suggest a repair description.
- What you type or dictate into AI features
- Draft write-ups, answer questions about your records and summarize what changed.
Under the hood
The basics, done properly.
- Private file storage on Amazon S3, encrypted at rest by S3, under your company’s own path.
- Every app page tells search engines not to index or archive it.
- Error monitoring configured not to send personal data by default.
- Heavy exports and personnel packets are built in the background; packet files are cleaned up hourly.
- Public QR scan endpoints are rate-limited.
- Links in every email point at your own workspace address — never a forged host.
Have a security questionnaire?
Send it over. We’ll answer every line plainly — including the things we don’t do. Found something that looks wrong? Tell us and we’ll look right away.
This page describes how HR PaperTrail works today. It isn’t a contract or a certification; our Terms of Service and Privacy Policy govern. Names shown belong to a fictional demo property.
Get started
Put your records behind the right doors.
Tell us a little about your operation. We’ll reach out within one business day to set you up — personally.