Granular permissions
By group, by module, by document folder - and by scope group (team, site, department) to limit what a manager sees to their own scope.
Precisely define who can view, update and export your HR data
View, edit and export rights set by group and by module, 2FA, SSO, login audit trail - every sensitive HR record stays where it belongs, in the hands of the people authorised to handle it.
Permissions by module
Groups
Group
Leave
Payroll
Documents
HR Admin
All
All
All
HR Manager
All
No export
All
Manager
Their team
✕
Their team
Employee
Own record
Own record
Own folder
Built for the HR data you never want leaked - or changed by mistake
2FA & SSO included
TOTP two-factor authentication on every account. SSO with Azure AD, OIDC or CTIE eAccess (Luxembourg) - three providers to choose from, included from your very first account.
Login traceability
Every login logged with timestamp, IP and authentication type. Sensitive changes (address, IBAN, banking details) are recorded with before and after values.
The security toolkit, delivered out of the box
Enterprise-grade controls on every myHR account, even the smallest - no paid add-on, no "enterprise tier" to unlock.
Custom groups
Create the groups that match your organisation - HR Admin, HR Manager, Manager, Employee, External.
Permissions by module
Leave, payroll, records, scheduling, training - each module has its own rights, assignable by group.
Permissions by folder
Differentiated access to document folders - a manager doesn't see medical records, payslips stay private.
Scope by target group
A group can be limited to a team, a site or a department - the manager only sees their own scope.
TOTP 2FA
Two-factor authentication via app (Google Authenticator, Authy, 1Password) - enabled per account or enforced company-wide.
3 SSO providers
Azure AD, generic OIDC, CTIE eAccess (Luxembourg) - three ready-made integrations, configurable without development.
Session expiration
Automatic logout after 8 hours of inactivity - configurable password policies (length, complexity, characters).
Login log
Full login history (date, time, IP, authentication type) and log of sensitive changes with before and after values.
Reassure your DPO in a single meeting
Our security documentation, the DPA and our compliance posture - ready to forward to your legal team on request.