Employee records

​

The dossier

An employee’s record is the single place their working life is documented. It is organised in slices so that a payroll specialist, a line manager and an HR generalist each see the part they are entitled to rather than one undifferentiated page.

​

Employment periods

Terms are dated, not current-valued. Each employment period carries: Everything downstream asks the record “what were the terms on this date?” — payroll for a retroactive month, a certificate listing the sequence of roles, a report on average Pensum by location.

​

Changing terms

A promotion, a Pensum change or a relocation is a new period, opened from the effective date. The previous period is closed the day before. The platform never overwrites history, because the history is what the payroll and the certificate are built from.

​

Recurring earnings

Allowances and other recurring items sit alongside the salary — also dated, also masked by the same salary-visibility rules.

​

Salary visibility

Salary amounts are hidden by default and masked at the API layer, not just in the UI.

• salaries:view-all — the global unlock. ADMIN+ only; deliberately not granted to HR staff.
• Salary access grants — hand-picked per team or per Standort, giving named HR staff visibility over a defined population. Administering grants is ADMIN-only.
• Managers read strictly below themselves in the org graph — never at or above their own level.

Routes serving per-employee data call the visibility check and mask the monetary fields when the viewer is not allowed. A masked response is a masked response; there is no client-side hiding of a value that was already sent.

​

Documents

The dossier holds contracts, certificates, diplomas, permits, medical certificates and anything else you attach. Files live in Azure Blob Storage; access is checked per request against the same permission model as the record itself. Documents can be imported in bulk from a local folder during a migration, and individual documents can be attached from an application when a candidate becomes an employee — the file does not need re-uploading.

​

Bulk import

New installations rarely start empty. The Excel master-data import creates users and employee records together from a spreadsheet, with a mapping step so your column names do not have to match ours. Because the import creates User rows, it is gated at the stricter of the two permissions involved — creating users is ADMIN-level, so the import is too. It runs in three stateless phases over the same re-uploaded workbook: Validation normalises AHV numbers and checks canton codes against the official list, and maps the human-readable values in your spreadsheet — marital status, nationality, work permit, salary type, locale — onto the platform’s enums. Two properties worth knowing:

• Each row is written in its own transaction, so one bad row cannot poison the batch.
• Existing dossiers are respected. A user who already has an employee record is reported as skipped — never duplicated, and never silently updated.

Row errors are structured codes rather than sentences, so they are shown in the importing user’s own language.

​

Deleting an employee

Deletion is ADMIN-only and is not the normal end of employment — that is offboarding. Deletion exists for genuine mistakes and for DSAR erasure obligations, and it respects the records the law requires you to retain.