How we protect your people, your pay and your data.

Every tool in the COC is a key, released per role. A recruiter sees recruiting, a rep sees their own day, and leadership sees what their role allows. The same rule governs the web and the app.

Every request from the phone app authenticates itself at a single gateway. No app endpoint trusts a request because of where it came from.

Sign-in supports passkeys and two-factor authentication.

Every amount is held as a whole number of cents, end to end. There is no floating-point arithmetic in a money path.

Each pay run is computed into a frozen snapshot with its receipts. It has to balance to the penny against what the paying partner reported. A correction is a new run that supersedes the old one; a finished run is never edited in place.

Pay structures are locked per quarter. A locked structure changes only by a dated amendment.

Integration credentials are encrypted per organization (AES-256-GCM) and are never kept in plain configuration.

Text and email outreach follows a recorded consent layer. Wearable data is opt-in, consent text is shown verbatim, and withdrawing consent deletes the data.

Applicant data can be exported or erased on request.

On anything that can be screenshotted or shared, such as leaderboards and the company feed, reps appear by callsign rather than legal name.

Each organization’s data is scoped by its tenant in the application, and each organization’s plan limits which tools exist for it at all.