Multi-tenant HR
Run HR for every business you own
and keep every one of them apart
Employee and intern records, leave, attendance, performance, recruitment and payroll records — for many organizations at once. Each one's data, documents and reports are walled off from the rest, and we can show you exactly where the wall is.
No card required · Free plan stays free for five people
Two organizations, Northwind Trading and Beta Logistics, sit either side of a tenant boundary. Northwind reads its own employee record in full. A request carrying that record's identifier, aimed at Beta Logistics, is refused with a 404. Beta Logistics' sensitive fields remain redacted.
- 78
- collections, every tenant row owned
- 25
- cross-tenant isolation tests
- 5
- independent enforcement layers
- 0
- known dependency vulnerabilities
Inside the workspace
Built for the work HR does daily
Not a directory with modules bolted on. These are live surfaces from the product, sharing the same people, departments and permissions.
Active employees
88
Interns
12
Pending leave
6
Contracts expiring
3
Headcount by department
- Engineering38
- Operations24
- Commercial17
Every figure is live
Headcount, leave, expiring contracts and certifications, computed from records — never a placeholder statistic.
Amara Okoro
Annual leave · 12–16 Aug · 5 working days
You cannot approve your own leave request. It must be reviewed by someone else.
Approvals with a spine
Manager then optional HR approval, overlap detection, working-day maths — and nobody approves their own request, whatever their role.
Skills matrix · 1 Awareness → 5 Expert
target ≥ 3- TypeScript
- PostgreSQL
- Kubernetes
- Incident response
2 people below target on Kubernetes
Capability, deliberately
A five-level scale with self-rating, manager verification and evidence, so gaps surface before they become a delivery problem.
Why teams move
What you are probably using now
Every option below is a reasonable choice for someone. Here is where each one starts to hurt, and what CirroPeople does instead.
Where most teams under 50 people actually are
Spreadsheets and a shared drive
- Leave balances drift, and nobody can explain a number
- Contracts and certifications expire unnoticed
- Everyone with the link sees salary
- No record of who changed what
The common first purchase
A single-company HR suite
- Assumes one company; a second means a second subscription
- One global role per person, so multi-entity staff are a fudge
- Interns modelled as short-contract employees
- Exports gated behind the plan you are trying to leave
Built for thousands of employees
Enterprise HCM
- Implementation measured in quarters
- Priced and configured for a dedicated HR function
- Capability you will not use for years
- Data residency and separation are a contract, not a demo
What CirroPeople does instead
Many businesses, one platform, no bleed
Every record carries the organization that owns it. Access is proven from a membership row on every request — the address in the URL grants nothing. Changing a slug, a record id or an export filter returns a 404, and we test that on every run.
A person can hold different roles in different companies
Roles live on the membership, not the user. The same accountant can be HR administrator in one business and an ordinary employee in another. There is no global role field to leak between them.
Internships are a real programme, not a short contract
School, programme, year of study, mentor, technology track, weekly reports, mentor feedback, final evaluation and an employment recommendation — with conversion to permanent staff that keeps the internship history.
Limits never hold your data hostage
Pass a plan limit and nothing is deleted or locked. You keep reading, reporting and exporting; you simply cannot add more until you upgrade or archive. Exports stay available even after a subscription lapses.
Sensitive fields are masked on the server
Salary, bank details, tax identifiers and medical notes are replaced before the response is built — not hidden with CSS. Support staff searching across customers see masked data unless they hold an explicit permission and give a reason, which is recorded.
The audit trail can answer the awkward question
Registrations, sign-ins, role changes, exports, payroll and document access, billing events and platform actions — all recorded, with passwords, tokens and headers stripped before anything is written.
How a request is authorised
Six steps, every single request
Nothing is cached, assumed or inherited from the URL. This sequence runs before any record is read — which is why an id from another customer resolves to nothing.
- 1
Authenticate
Verify the signed, HTTP-only session cookie
- 2
Resolve
Look the organization up by address — the address grants nothing
- 3
Prove membership
Require an active membership row for this person, this organization
- 4
Derive
Take permissions from that membership, never from the URL
- 5
Scope
Force the organization filter onto every read and write
- 6
Mask and record
Hide sensitive fields, then write the audit entry
Audit trail · live
Every access is recorded — including the refused ones. Passwords, tokens and authorization headers are stripped before anything is written.
The surface area
Everything an HR team actually does
People
Employees, interns, contractors and consultants in one directory
Leave
Types, balances, carry-over, approvals, holidays, team calendar
Attendance
Office, remote, hybrid and field, with lateness and overtime
Performance
Cycles, competencies, goals, check-ins, improvement plans
Recruitment
Vacancies, candidates, interviews, scorecards, offers
Skills
A five-level matrix with verification and department gaps
Training
Catalogue, enrolments, costs, certificates, renewal alerts
Assets
Register, assignment history, acknowledgement, returns
Onboarding
Templates, owners, due dates, evidence, overdue tracking
Documents
Four visibility levels, expiry tracking, protected downloads
Payroll records
Compensation history, runs, payslips, immutable once final
Reports
Excel, CSV and PDF for every register, permission-checked
Give your HR team a system of record
Start on Growth with every feature switched on for 14 days. Import a spreadsheet, invite a colleague, and judge it against your own data.