Security and privacy
Built to be trusted with people and money
Manager holds your projects, your people's check-ins and your finances. Here is how that data is protected, in plain words.
Company isolation
Your company's data is separated from every other company's in the database itself, not only in the application.
- Every company-owned table carries the company's identifier and is protected by PostgreSQL row-level security
- The application connects with a database role that cannot bypass those rules
- The company is set inside each database transaction, never for a whole connection, so it cannot leak between requests
- Automated cross-company tests in the test suite fail if one company can see another's data
Permissions, deny by default
Screens, API calls, exports, search, notifications and AI requests use one central permission check.
- Nothing is visible unless a role grants it
- Roles are built from a catalogue of actions; nobody can grant more than they hold themselves
- Before a role definition or privacy policy is saved, admins see who gains or loses access
- Role and privacy policy changes are versioned and audited, and a custom role can be rolled back to an earlier version
- A segregation-of-duties report, and access reviews that admins can run
Sign-in and accounts
Strong sign-in for everyone, and stronger for the roles that hold the keys.
- Multi-factor authentication with an authenticator app and one-time recovery codes
- Required for owners, admins and finance roles
- SAML 2.0 single sign-on designed for Okta, Microsoft Entra ID and Google Workspace, and SCIM provisioning for Okta and Entra ID
- Rate limits and lockouts on sign-in, and new passwords checked against known breached passwords when that check service is reachable
- Session limits, and sign out everywhere when a password is reset
Audit and support access
Security-relevant actions are recorded and kept for at least two years.
- Sign-ins, permission changes, exports, AI actions, approvals and data requests are in the audit log
- Owners and admins can search and export it
- Through the product, Manager support staff have no access to your company unless an admin grants read-only access for one ticket and a set time
- Every page support staff view is written to your company's own audit log
- Thisys staff who run the service use a separate console, open only to staff added on the server and only after an authenticator code, asked again every 12 hours
- That console shows operating information such as company name, plan, seat counts and the owners' sign-in email, never your business data: no people records, projects, time, money, check-ins, files or AI content. Reading your records still needs the support access your admin grants
- Every view and action in the staff console is written to a log that cannot be edited
Encryption and infrastructure
How data is protected in transit and at rest. Production hosting is being set up for launch.
- TLS for every connection, with security headers and a content security policy
- Encrypted off-server backups with point-in-time recovery, being set up for launch
- Multi-factor secrets encrypted at rest with a separate key; passwords stored only as slow, salted hashes
- Secrets are never kept in code; production access will be limited to two named people
- Attachments are private: every download is permission-checked and served by a short-lived link
Privacy by design
Manager is designed for the Australian Privacy Act, UK GDPR and EU GDPR.
- Every person can see who can see each kind of their data, and download all of it
- Export and erasure on request; finance records are kept for at least their legal minimum, and erasure anonymises the person in them
- Retention settings for check-ins, AI history, notifications, deleted files and hiring candidates, with a daily clean-up
- People figures such as skills coverage and utilisation are hidden for groups of fewer than five
- Widening who sees personal data takes effect only after a notice period, and everyone affected is told
- Leave reasons are never stored
AI rules
AI explains, recommends and drafts. It never scores or judges people.
- Risk scores are fixed formulas, never model output, so the same facts always give the same score
- No AI rating, ranking or judgement of individuals, and no AI in hiring decisions, in line with the EU AI Act's rules on high-risk uses
- Every AI call goes through one gateway: permission-checked, minimised, metered in credits and logged
- The AI only sees what the person using it is allowed to see; private coaching stays private
- AI actions start at Advise, which only suggests. An admin can choose Propose, which needs a person's approval, or Act, which applies at once; every action is audited, and actions that can be reversed can be undone for seven days
- Manager does not use your company's data to train AI models
Where your data lives
Production data is to be hosted in London, in the United Kingdom, including data for Australian customers, with cross-border safeguards described in the privacy policy. AI prompts are to be processed by Anthropic in the United States, with the minimum data needed; the data processing agreement and transfer safeguards will be in place before launch.
A regional AI processing option for Enterprise customers is planned. The full list of sub-processors will be published before launch.
Documents and assurance
Data processing terms
A data processing agreement for customers is being prepared: a first draft is written and waits for legal review. It will be available before launch. Ask us about it.
Service status
The current health of the web app, the database and background jobs, with no sign-in needed, is on the status page. It shows the state now; incident history is not kept there yet.
Penetration test
An independent penetration test is planned before public launch, with no open critical or high findings allowed at release.
Report a vulnerability
Found a security problem? Tell us and we will respond promptly. Please do not test against other customers' data.
Privacy policy
How we handle personal information: privacy policy and cookies.
Questions from your security team?
Send them over. We will answer in writing, with the detail your review needs.