Security proof buyers can review before production employee data enters HRM.
This datasheet is intentionally honest: it separates configured controls from implementation responsibilities and unsupported certification claims.
Control checklist
Evidence required for production HRM handoff.
- Tenant isolationEvery user, employee, candidate, document, payroll run, backup, invite, reset, and audit event belongs to one tenant context.
- Role-based permissionsSuper Admin, HR Admin, Recruiter, Hiring Manager, and Employee receive only the operations required for their work.
- MFA and recoveryAdmin MFA uses authenticator enrollment and recovery-code hashing. Demo credentials must not be used for production tenants.
- Invite and reset flowProduction users should be invited or reset through controlled email flow instead of manual password sharing.
- Document controlsDocument upload rules, file limits, access restrictions, retention, signed URL expiry, storage provider, and export ownership are confirmed during implementation.
- Backup and restoreBackup job, storage target, checksum/manifest, restore drill, and restore owner must be recorded before go-live.
- Audit trailImport, payroll, attendance, leave, document, role, support, backup, and sensitive auth events should be visible for review.
- Unsupported boundariesEyeLogs HRM is not claiming SOC 2, ISO 27001, HIPAA, certified statutory filing, or payroll processor status by default.
Buyer note
Open production proofProduction readiness is proven, not assumed.
Live backend health, clean configuration, real email, real document storage, MFA, backup, restore drill, and audit evidence must be checked in the buyer environment.