RBAC: each person sees exactly what they need, nothing more
Role-based access control (RBAC) is the principle 4mystaff is built on: you define roles — employee, team manager, HR, admin — and each role gets exactly the permissions it needs. An employee sees only their own file; a manager sees the people on their team, per the org chart; HR sees the whole company; the admin manages configuration. Highly sensitive data (salaries, medical information) carries an extra restriction level. This “least privilege” principle dramatically reduces the risk surface — no one has access to data they don’t need for the job.
The audit log: full traceability
For sensitive data, controlling access is not enough — you must also be able to prove it. 4mystaff keeps an audit log that records actions on personnel data: who viewed a file, who changed a salary, who exported an employee list, with author, timestamp and detail. This log answers directly to the GDPR accountability principle and is invaluable when investigating an incident, at a security audit, or in a labour dispute when you must show who changed what and when.
2FA and SSO/SAML: authentication at corporate standard
A password alone is no longer enough for sensitive data. 4mystaff supports two-factor authentication (2FA), via an authenticator app or code, to prevent access with a compromised password. For organisations with centralised corporate identity, SSO/SAML sign-in (Google Workspace, Microsoft Entra ID / Azure AD) means employees use the same account as for the rest of the company’s apps, and IT applies security policies from one place. When an employee leaves, disabling the account in the identity provider automatically revokes their 4mystaff access too.
GDPR compliance: employees’ rights, in practice
GDPR gives employees concrete rights over their data — access, rectification, portability, erasure — and the firm must be able to honour them. 4mystaff provides the tools: on an access request, you export the person’s data in a structured format; you apply retention policies per document type (payroll records 50 years, other documents per law) and erase what no longer has a basis; you document the processing basis for each data category. Combined with RBAC and the audit log, these tools let you demonstrate compliance, not just assert it.
