ProtoHR

Growing organizations running HR on spreadsheets and disconnected tools face a common problem: employee records, payroll, leave, and time tracking live in silos, and compliance requirements differ by country. We set out to build a single platform that could serve multiple independent tenants securely from shared infrastructure, without any risk of data leaking across tenant boundaries.

Payroll compliance was the hardest constraint: every country has its own tax brackets, social contributions, and statutory rules, and those rules change. The platform needed to support new countries and evolving tax logic without destabilizing existing payroll runs, while giving finance teams full control over the approval lifecycle — from draft calculation through disbursement and locking.

Finally, the product needed to be modular: not every tenant needs payroll or time & attendance on day one, so features had to be licensable per tenant and safely gated at the API layer, not just hidden in the UI.

We architected ProtoHR as a Turborepo monorepo with a Next.js web app, a Fastify API, and a BullMQ worker for background jobs such as email delivery and payslip PDF generation, all sharing a Drizzle ORM schema and a common RBAC and permissions package.

Tenant isolation is enforced at the database layer, not just in application code: every tenant-scoped table carries a tenant_id, and PostgreSQL row-level security with FORCE ROW LEVEL SECURITYguarantees a request can only ever see its own tenant's data, even if a query were written incorrectly. The API sets the tenant context for every authenticated request before any query runs.

For payroll, we built a dedicated tax engine per country — starting with the US, UK, UAE, Canada, Germany, France, Kuwait, Oman, Pakistan, Qatar, and Saudi Arabia — behind a common interface, so new jurisdictions can be added without touching the core payroll run logic. Payroll runs move through an explicit status lifecycle (draft, calculating, review, approved, disbursed, locked), with entries and line items becoming progressively immutable as a run advances, protecting finalized payroll from accidental edits.

Module licensing is enforced server-side: a Redis-cached check against each tenant's enabled modules gates access to payroll, leave, and time-tracking routes before any handler runs, so tenants only pay for — and only see — what they've licensed.

Every unit and integration test runs against a real PostgreSQL database rather than mocks, and a custom idempotent migration runner powers CI, staging, and production deployments identically, so schema changes are verified the same way everywhere before they reach a live tenant.