Built for data you cannot be casual with

What is built in today

Caosira is early-stage and has not pursued formal certifications like SOC 2 yet. These are the protections that exist in the product now.

One company never sees another

Every company's data is separated at the database with row-level security, not just filtered by app code. One company can never query another's rows.

Two-step sign-in

People can protect their login with an authenticator app. Admins can make it required for everyone, and the database refuses access until the second step is done.

Access by area

Give someone access to one area, like recruitment or assets, without making them a full admin. Least privilege, not all-or-nothing.

Every change is recorded

Changes to employee records are logged with who made them, when, and the before and after values. Sign-ins are logged too. Admins and HR see both company-wide.

Sensitive fields kept apart

National IDs and bank details live in a separate table, masked by default, and visible only to admin or HR and the employee themselves. API keys are hashed, shown once and revocable at any time.

Private files and photos

Employee documents, resumes, company files and profile photos sit in private storage with per-file visibility. Nothing is in a public bucket.

Real biometric check-in

Optional clock-in verification uses WebAuthn platform authenticators (Face ID, Touch ID, Windows Hello), a genuine cryptographic check verified on the server.

Rate limits and safe links

The careers form and the public API are rate-limited. Sign-up, invite and password-reset links need an explicit click, so email scanners cannot use up a one-time link.