Trust and privacy

Isolation

Every customer company is one organisation row in a shared Postgres database. Employee records, leave, hiring, and the rest of the product data are read and written throughtenantDb(), which adds that organisation's id to every query. A user in one workspace cannot load another workspace's rows.

Headcount staff who help with support are a separate platform-user role, not a customer admin with implicit access to every tenant. Impersonation is audited and read-only. Cross-tenant and out-of-scope reads return not found (404), not forbidden (403), so the response does not confirm that a record exists.

Sign-in

Password sign-in is the default. TOTP-based two-factor authentication is available on each account. An organisation's HR or admin can require 2FA for HR and admin users. Google sign-in is optional when the operator has configured it.

SAML and SSO are not available yet. We will say so here when that changes, rather than implying a directory integration we have not shipped.

Where data can run

Postgres is whichever host the operator sets in DATABASE_URL. This repository does not pin a published data region. Object storage in this environment is local disk (S3 is not configured). When S3 is configured, the bucket uses S3_REGION, or us-east-1 if that variable is unset. Ask us in writing which host your workspace uses if you need it for a questionnaire.

What Headcount is not

• Not a payroll processor. Pay runs stay in Xero (or your payroll system). Headcount can connect a Xero organisation; it does not calculate PAYE, KiwiSaver, or tax.
• Not a law firm and not employment-law advice. Leave rules, contract templates, and statutory workflows are software. They are not a substitute for an adviser.
• Not a source of market benchmarks, invented headcount statistics, or compliance badges we do not hold.

Privacy law we write against

The product is built first for New Zealand employers. The Privacy Act 2020 is the primary framework we design against. Australian workspaces are a second jurisdiction; we treat the Australian Privacy Principles as the AU counterpart.

We do not claim GDPR coverage. Headcount is not marketed as an EU-resident product. If you employ people in the EU and want that data in this software, say so before you send it — GDPR may then apply, and we have not published a GDPR programme.