What we do today. What we do not do yet.
This page lists protections that exist in the product now, and says plainly where there are gaps. We do not claim certifications we do not hold.
Protections in place today
Organisation scoping
Data is scoped to your organisation id in both services (application-level scoping).
Roles and permissions
Role-based access with per-module admins. People without access see a request-access path, not a dead end.
SCIM provisioning
Provision and deprovision people from your identity provider with SCIM. Admins create and revoke the tokens in the product.
Audit log
Administrative and sensitive actions are recorded in an audit log that administrators can browse in the admin console. Known secret and personal fields are masked in entries; the masking is pattern-based and may miss unusual fields.
Encryption of sensitive data
Payroll data (salaries, bank details, payslips, payment files) is encrypted at field level with AES-256-GCM using per-organisation derived keys. Some other sensitive fields, such as ticket titles and descriptions, government identifiers and two-step verification secrets, use AES-256 field encryption. Most other content, such as comments, files and HR records, is protected by access controls and is not separately encrypted by the application.
AI-client access (MCP)
AI-client access through MCP is off for every organisation until an administrator turns it on. When it is on, a connected AI client acts with the permissions of the person who created its token, and payroll, billing and admin settings are not offered to it. Anything a client reads leaves OneApp and is processed by the AI provider of that client.
API keys and scoped intake
Programmatic access uses API keys. The service portal and monitoring alerts have their own intake endpoints.
What we do not do yet
Buyers ask about these.
SAML single sign-on
An Owner can save a SAML configuration, but SAML sign-in is switched off: there is no SSO button on the sign-in page and sign-in through an identity provider does not work yet.
Inbound email intake
Email-to-ticket is not available. Raise tickets in the app, the service portal, the channel API or from monitoring alerts.
Customer-managed encryption keys
Encryption keys are held by OneApp. Bringing your own keys is not available yet.
Certifications and audits
We hold no security certifications and have no independent audit report to share. We do not claim any.
Uptime and backup commitments
We do not offer an uptime commitment or service level, and we do not publish backup or recovery commitments.
What stays with you
- You decide who gets which role and module. Review access when people change jobs or leave.
- Payroll rules are yours to define and verify for your jurisdiction. OneApp generates payment files and never moves money.
- Sample data in a new workspace is labelled as sample. Remove it before you go live.