HIPAA-minded employers
You may store leave documentation that should not be casual reading. Roles are how you describe the boundary.
Roles and access
Who can open a file is a product decision.
Operators, managers, and employees do not share a login. Sensitive fields sit behind roles you can explain to counsel — and to the person whose file it is.
Why it matters
Medical notes, government IDs, and compensation should not ride along with a birthday list. Least privilege is the default. Extra access is granted, not assumed.
Staffquorum ships with distinct roles: operators who run people ops, managers who approve work for their team, and employees who punch, request leave, and complete their own tasks. HR-only notes and certain documents stay with operators. Opens and edits can leave an audit event. The longer security story — encryption, backups, HIPAA-minded posture — lives on the security page. This page is about the day-to-day question: who is allowed to see this?
Join the waitlistAccess
Who can see what
| Field | Operator | Manager | Employee |
|---|---|---|---|
| Directory & job info | Edit | Team | Self |
| Time punches | All | Team | Own |
| PTO balances | All | Team | Own |
| HR-only notes | Yes | No | No |
| Compensation | Yes | No | Self* |
On the record
What you get in Staffquorum.
- Separate roles for operators, managers, and employees.
- Sensitive fields off the default manager view.
- HR-only notes and selected documents behind operator access.
- Audit events on opens and changes to records and files.
- No shared-password design. No invented compliance badge on this page.
How it runs
A week in this workflow.
01
Give people a role
An employee is not a manager. A manager is not an operator. The product starts from that split.
02
Grant extras on purpose
If someone needs to see pay data or a restricted file, that is an explicit grant.
03
Review the trail
When counsel asks who opened a record, you have events to walk through — not a shrug.
Who uses it
Built for the jobs you already have.
Small teams wearing two hats
A founder may be operator and manager. That is two roles on one person — not one shared password for the office.
Related
These workflows share the same record.
HR-only notes
Private context that does not leak to the team view.
People ops sometimes needs a note that is not for the manager and not for the employee. Staffquorum keeps that space on the file — behind a role.
People directory
One employee record. Searchable. Owned.
Name, job, site, manager, documents, and status sit on a single file. The directory is how you find someone — not a Friday export from payroll.
Documents
Files on the record, not in a drive named HR_SHARE.
Offer letters, handbooks, I-9 packets, and signed acknowledgements attach to the employee. Access follows the same roles as the rest of the product.
Manager tools
Approvals, coverage, and birthday emails that stay private.
Managers get the queue they already run: time exceptions, leave requests, and who is out. Birthday dates stay on the file — not a company-wide calendar.
For encryption, backups, and how we talk about HIPAA, see Security.
Want this workflow on your roster?
Tell us your headcount and what you run today. We will write back from hello@staffquorum.com when we can show you the product.