HR & Payroll SaaSIn development
Multi-Country HR & Payroll Platform
Our own multi-tenant HR and payroll platform, in development: people, attendance, time off, approvals and a multi-country payroll tax engine — built security-first, ahead of its first pilot.
- 370 endpoints behind 120 permissions
- 463 backend tests + 7 architecture rules
- Tax engine: Pakistan, US federal + 15 states
HR & payroll · Updated
The challenge
HR software holds the most sensitive data a company has — national IDs, bank details, pay — and payroll tax changes by country, by state and by year. This platform is built for both from the first commit: strict tenant isolation, sensitive fields encrypted, privileged actions audited, and tax rules stored as versioned data rather than buried in code.
What we built· built by our founder, Haseeb Attaullah
- Ten modules on one model — access, organization, people, attendance, time off, approvals, payroll setup, performance, partners and platform administration — across 57 controllers and 370 endpoints
- 120 permissions enforced at the endpoint and again in the service layer, roles scoped to companies, locations or departments, and two-factor authentication administrators can be required to use
- National IDs encrypted and hash-indexed, revealed only with a dedicated permission and audited when they are; bank accounts that need a second person's approval, with IBAN and US routing-number checks
- A versioned payroll tax engine covering Pakistan, US federal and 15 US states, with a calculator that grosses up and compares scenarios side by side
- Attendance on the server clock in each location's time zone, rotating and night shifts, punch import from Excel or CSV; leave with accrual, proration, carry-over and a balance ledger
- Approval workflows of one to five steps with conditions, bulk decisions, and live notifications over SSE
- Hardened like a product: cookie sessions with CSRF protection, strict security headers, per-tenant rate limits, 463 backend tests, 328 front-end tests with accessibility checks, and 7 architecture rules enforced in CI
How it fits together
Users
Web app
React 19 and TanStack Query
API
ASP.NET Core on .NET 10
57 controllers, 370 endpoints, 120 permissions
Payroll tax engine
Versioned; Pakistan, US federal and 15 US states
Approval workflows
One to five steps; live notifications over SSE
Data
PostgreSQL
EF Core 10; national IDs encrypted and hash-indexed
Why it matters
This is where we hold our own work to the standard we'd want from someone building for us. It isn't live yet — payroll runs come next — but the foundations are the part that's expensive to retrofit: isolation, encryption, permissions, audit, and tax rules versioned by country and year. If you're building a platform that holds sensitive data, those are the parts we'd get right first on yours too.
Our founder's part
Haseeb Attaullah: Founder and architect — product decisions, the domain and security model, and the multi-country payroll tax engine.
Building something like this?
Tell us what you're building. We reply within 0–4 hours with honest feedback on scope, timeline and whether we're the right fit.