Security, access and administration

Who sees what, who can do what, and a record of all of it. 19 features.

Single sign-on with OpenID Connect: Every screen and API call needs sign-in, with tokens verified on the server.
Four roles: Administrator, Super user, Planner and Viewer, each with a default set of capabilities.
Seventeen capabilities: Permissions such as raise demand, challenge, release to recruiting, approve plan versions and load actuals.
Server-side authorisation: Capabilities, data scope and salary visibility are enforced on the server, not only in screens.
Data scope by organisation and geography: Each person sees only their part of the organisation.
Separation of duties: Administrators run the system but do not see individual salaries by default.
Salary visibility: individual salaries and single-position costs show only to people allowed to see them, with "Withheld" otherwise.
Minimum group size: No cost figure covering fewer than the company's minimum (at least 3) is shown to anyone without salary visibility.
Access management: Invite people, set role and scope, deactivate and reactivate; people are never deleted.
Invite from a file or outside the company: Bulk invite by CSV, and invite people outside the workforce.
Roles screen: Explains each role in plain words; Administrators adjust what a role can do with a typed confirmation.
Last Administrator guard: At least one Administrator always keeps access management.
Typed confirmation for locked settings: Risky changes such as reporting currency need a typed phrase.
Append-only audit trail: Change and access logs that cannot be edited, enforced by database grants.
Access audit: Reports run, exports, approval reads and every assistant call are recorded.
Audit log screen: One searchable timeline with filters, entry details and CSV or PDF download.
Settings landing: One Settings area behind the gear, showing only the boxes each person may use, with alerts.
UK hosting: Hosted on Azure in UK South with a London database region and encrypted weekly backups.
Security checks in the build: Static analysis, secret scanning and dependency audits run before every deploy.

Bring your plan. We'll bring Kivos.

A walkthrough built around your structure: your entities, your currencies and your approval rules.

info@kivos.co.uk

Become a design partner

We are working closely with a small number of finance teams to shape what comes next. Partners get early access and a direct line to the people building it.

Ask about design partnership