What a record holds
Identity and contact details, emergency contact, employment metadata (department, job title, join date, probation end, employment type, residency status), the reporting line, the access role, and salary as a reference figure. Children's dates of birth are captured separately because childcare leave entitlement depends on them.
Sensitive fields
NRIC is encrypted with AES-256-GCM before it is written, using a key you supply and hold. The stored value is ciphertext; the plaintext exists only in memory during a request that explicitly asks for it. Every decryption writes an audit entry naming the admin who did it and the employee whose identifier was read.
In the interface, NRIC and salary are masked by default. An admin has to click to reveal, which turns reading someone's identifier into a deliberate act rather than something that happens by walking past a monitor.
Onboarding
A guided wizard walks an admin through creating a new joiner: identity and contact, employment terms, reporting line and approvers, starting documents. On completion the employee's leave entitlements are created from their join date and a welcome email goes out with a one-time activation link. They set their own password; nobody ever emails them a credential.
Offboarding
Removing a person is a request, not a button. An admin raises a deletion request with a termination date, reason for leaving and exit notes; a super admin reviews and approves it. That two-step exists because deleting an employee cascades through their leave history, claims and acknowledgements, and because a leaver's record is often exactly what you need three months later when a question comes up.
Approving the request revokes the person's live sessions immediately. Role changes and status changes do the same — a demoted admin does not keep admin access until their session token happens to expire.
Documents and notes
Each employee has a document store for contracts, certifications and letters, and a separate management notes area for performance-review material. Management notes are visible only to super admins and the managing director; a regular admin working on leave and claims cannot read them.