> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hr-easy.nlead.ch/llms.txt
> Use this file to discover all available pages before exploring further.

# Surfaces

> The three front ends — dashboard, portal, and the iOS app — and who lands where.

Swiss HR Easy presents one system through three surfaces. Which one a person sees is a
product of **who they are in the organization**, not of how they signed in.

<CardGroup cols={3}>
  <Card title="Web dashboard" icon="table-columns">
    `/dashboard` and the module routes beside it. Oriented at HR and management: recruiting,
    employee master data, payroll, organization — plus functions everyone needs, like feedback,
    surveys and decisions.
  </Card>

  <Card title="Web portal" icon="user">
    `/portal`. Self-service for applicants and employees: applications, onboarding, contracts,
    certificates, compensation, time and absence.
  </Card>

  <Card title="iOS app" icon="mobile">
    SSO-only employee self-service — leave, sick leave, time tracking and the payslip. It consumes
    the [versioned portal API](/api-reference/introduction).
  </Card>
</CardGroup>

## One identity for the whole relationship

A person is **one `User` row for life**. There is no separate applicant or candidate
record. An applicant is a `User` with role `APPLICANT`; on hire, an `Employee` row is
attached to the *same* user, and every artefact — applications, notes, references,
contracts, certificates, compensation — continues to hang off that one identity.

This is [ADR-011](/development/adr), and it is why the platform can carry a person
from a job ad to a work certificate without re-keying anything.

<Note>
  Because identity is continuous, so is the audit trail: a hire's application history and their
  employment history are the same person's history.
</Note>

## What each surface shows

| Function                      | Dashboard | Portal | iOS |
| ----------------------------- | :-------: | :----: | :-: |
| Positions and applications    |     ●     |   ○¹   |     |
| Employee master data          |     ●     |        |     |
| Payroll administration        |     ●     |        |     |
| Payslip (own)                 |           |    ●   |  ●  |
| Contracts (own)               |           |    ●   |     |
| Work certificates (own)       |           |    ●   |     |
| Compensation self-view        |           |    ●   |  ●  |
| Time tracking                 |     ●²    |    ●   |  ●  |
| Leave and sick-leave requests |     ●²    |    ●   |  ●  |
| Feedback, surveys, decisions  |     ●     |        |     |
| Onboarding forms and uploads  |           |    ●   |     |

<sup>1</sup> The portal shows an applicant *their own* applications only.
<sup>2</sup> Time tracking and staff absence are dashboard-group routes that employees also reach,
which is why an employee may see dashboard chrome around them.

## Portal gating

The portal decides what to show from **facts about the person**, not from a role
scalar:

* The presence of an `Employee` record unlocks contracts, certificates, and
  "Lohn & Einstufung".
* An open `PersonalDataForm` unlocks the onboarding section.
* "Meine Bewerbungen" is applicant-appropriate and always available.

The compensation view is a strict self-view: it never compares the viewer against
anyone else. That is a deliberate constraint from
[the design philosophy](/concepts/design-philosophy).

## Authentication per surface

| Surface   | Entra ID SSO | Magic link |
| --------- | :----------: | :--------: |
| Dashboard |       ●      |      ●     |
| Portal    |       ●      |      ●     |
| iOS       |       ●      |            |

The iOS app is SSO-only by decision — a mobile client holding a long-lived magic-link
session is a materially worse credential story than a token from the identity
provider.

<Warning>
  The surface architecture is captured in ADR-012, which is **Proposed, not yet accepted**.
  Acceptance is blocked on two access-control findings that the ADR itself records. Treat this page
  as a description of current behaviour; the routing mechanism may change when the ADR lands.
</Warning>