Data security in HR software: what 'multi-tenant' should mean
Why database-level isolation, RBAC and audit trails matter more than a security badge on a homepage.
HR software holds some of the most sensitive data a company has: salaries, bank details, national IDs and health-adjacent information. "Multi-tenant" should mean each organization's data is genuinely isolated — not just filtered by an application query that a bug could bypass.
Defense in depth
The strongest designs enforce isolation at the database with row-level security, so even a mistaken query returns nothing across tenants. Layer role-based access control, encryption of sensitive fields, and an append-only audit trail on top.
Questions to ask a vendor
How is tenant data isolated at the storage layer? Who can reveal sensitive fields, and is every reveal logged? Do you support SSO and SCIM so access follows your identity provider?