Apex Enterprise Systems People & Operations Platform Sign in
One platform, one audit trail

One secure workspace for people, payroll, projects and IT.

Apex Enterprise Systems runs the whole employee lifecycle in one place — hiring, attendance, leave, multi-currency payroll, projects, messaging, file sharing, video calls and IT support. Because it is one system rather than six, an approval knows who your manager is, a payslip knows what you claimed back, and every sensitive action lands in the same tamper-evident log.

Sign in to the portal See what is inside
20+
Modules

from attendance to the vault

90+
Permissions

granular, role-driven

3-tier
Approval gates

on payroll and bank changes

Hash-chained
Audit

verifiable on demand

Why one system

Separate tools lose the connections that matter.

A spreadsheet for attendance, a chat app, a drive, a meeting link and a payroll file is five places where the same person exists five times. The attendance sheet does not know who approves the regularisation. The drive does not know who left last month. The payroll file does not know what anybody claimed back.

Here those are one record. A resignation opens the notice period and the clearance checklist. An approved expense claim lands on the payslip for the month it was filed against and cannot be paid twice. Removing a role removes the menu items, the screens and the API access together, because navigation and authorisation read the same permission map.

Nothing here is a plug-in. Permissions, approval routes, attendance rules and payroll policy are settings an administrator changes, not code a developer deploys.

The platform

Six areas, built to work as one.

Each area is a full module with its own screens, permissions and audit events — and each one hands off to the next instead of ending at its own edge.

People & lifecycle

Every stage of employment in one record, from the first interview to the relieving certificate.

  • Employee directory with a live org chart derived from reporting lines.
  • Recruitment pipeline and onboarding requisitions with IT provisioning and executive sign-off.
  • A resignation funnel the employee drives themselves: submitted, acknowledged by their manager, decided by HR.
  • Offboarding with separate IT, HR, Accounts and department clearance gates, plus a final settlement calculation.
  • Issued certificates and ID cards carry a QR code anyone can verify publicly without signing in.

Attendance & time

Hours recorded from the terminal people actually use, with the exceptions real workplaces need.

  • Biometric terminal registration with device tokens and a live punch stream.
  • Missed-punch regularisation, routed to whoever is in the reporting line.
  • Per-person exemptions: flexible hours with no shortfall deduction, for people whose work is not clock-shaped.
  • Holiday calendars and leave types with entitlements, balances and encashment.

Payroll & money

Multi-currency payroll that nobody can push through alone.

  • A three-tier run: HR prepares, the executive approves, Accounts disburses against a bank reference.
  • Salaries in several currencies, with the exchange rate snapshotted onto each payslip.
  • Expenses and claims: reimbursements, one-off allowances and advance recoveries, approved by finance and absorbed by the month’s run.
  • Salary bank-account changes need three different people — the requester can never sign their own.
  • Attendance shortfall, unpaid leave and tax all shown as separate lines, never one netted figure.

Collaboration

Conversations, files and calls inside the portal, not scattered across three outside services.

  • Channels and direct messages delivered over a WebSocket gateway, with typing indicators, read receipts and unread counts that follow you across every screen.
  • A shared drive with resumable chunked uploads for large files, folder-level sharing, trash and restore.
  • Public download links for people outside the portal — one file, optionally password-protected, never a browsable folder.
  • In-portal video calls with screen sharing, a lobby, host controls and reactions. No external meeting service.

Projects & delivery

Work tracked where the people doing it already are.

  • Projects with rulebooks, task assignment, revisions and deadline concerns that escalate rather than go quiet.
  • A sales pipeline for client-facing teams.
  • Meetings and a shared calendar, with an approvals inbox that collects everything waiting on you.
  • An IT helpdesk with assets, tickets and service-account requests.

Security & governance

Access is a configuration, not a code change — and everything sensitive leaves a trace.

  • Role-based permissions with per-user grants and denials, time-limited where needed, managed from a console.
  • A second Financial Security PIN in front of payroll, salaries, bank details and the credentials vault.
  • Device-bound sessions, login lockouts and forced password rotation on first sign-in.
  • A hash-chained audit trail that can be verified on demand, so an altered entry is detectable.
  • Impersonation exists for support, but it is requested, approved and recorded.

Security by construction

Two locks, one trail, and no self-approval.

Sensitive areas are protected twice: once by the role you hold, and again by a PIN entered at the moment you open them. Separation of duties is enforced in the authorisation layer, so it holds whether a request arrives from the interface or from a script.

Role-based access

Roles grant dotted permissions; per-user grants and denials adjust the edges, optionally expiring on their own.

Financial Security PIN

A second factor in front of payroll, salaries, bank details and the credentials vault — per session, not per login.

No self-approval

Nobody approves their own expense claim, bank change or resignation. Not even the root account, by design.

Tamper-evident audit

Each entry is hashed onto the previous one and sealed hourly, so a quietly edited record stops verifying.

Sessions are bound to the device that created them, repeated failures lock the account, and a first-time sign-in must set a new password and PIN before anything else opens.

Running it

Built to be operated, not just installed.

The people who keep this running get first-class screens too — because an outage you cannot see is an outage you cannot fix.

Module-level status board

Every module probed on a schedule, with 24-hour uptime history, so you can answer “was it down, and for how long?” instead of only “is it up now?”.

Separate queue pools

Long imports run on their own workers, so a fifteen-minute spreadsheet cannot hold up a notification.

Import & export

Employees, attendance, payroll items, holidays, departments and exchange rates, validated before anything is written.

Data archival

Age-based archival you preview before it runs.

Developer settings

Deployment diagnostics and safe maintenance actions, with secrets reported as configured rather than printed.

Audit trail

Filterable by module, event and person, with on-demand chain verification.

Architecture

Boring where it counts, modern where it helps.

A single Laravel application with PostgreSQL and Redis, a small Node gateway for real-time delivery, and browser-to-browser calls. It runs on one modest server and scales out without rewriting: the gateway fans out through Redis, so adding a second instance adds capacity rather than confusion.

Authorisation stays in the application. The gateway never decides who may join a room — it checks a short-lived signed ticket the application issued, so permission logic lives in exactly one place.

Laravel · PostgreSQL · Redis
Queued work, cached settings and scheduled jobs on one connection each.
WebSocket gateway
Signed connection tokens, room tickets and Redis pub/sub fan-out across instances.
Peer-to-peer calls
Media flows browser to browser, with STUN and short-lived TURN credentials minted per user.
Docker, one VPS
Isolated local, staging and production stacks on a single host, with scheduled backups.

Already part of the organisation?

Sign in with your corporate email. If this is your first time, you will be asked to set a new password and a Financial Security PIN before anything else opens.

Sign in