open-source, self-hosted HR platform
One continuous employee record — from requisition to settlement. Recruit, onboard, track time, review and offboard in one system, with encrypted PII, four-tier RBAC and a full audit trail, on infrastructure you control.
The live demo runs on mock data, with no backend required. Changes are local to your browser session and reset on reload.
Onboarding status
Live activity
How to choose
Every HR system answers the same three questions. Which answers your organisation can live with is the real decision — so here they are side by side, including where the other approaches win.
| Cloud HR platforms Hosted and managed for you by the vendor | Assembled open source Separate modules you integrate and secure | Peoplevate One record, compliance in the base system | |
|---|---|---|---|
| Where does employee personal data physically live? Not who the vendor is — where the records actually sit. | Cloud HR platforms With the vendor, in a multi-tenant store. Residency and sub-processors become commitments the vendor manages on your behalf. | Assembled open source Wherever each module put it — often several databases, each with its own access model. | Peoplevate In your PostgreSQL database and your encrypted uploads volume. No multi-tenant store, and no vendor in the data path. |
| Who has accessed a record — and can you prove it? Not whether a permissions screen exists — whether you can reconstruct what happened. | Cloud HR platforms Through the vendor’s own access tooling. The depth of retained audit history varies by product and by plan. | Assembled open source Partly. You collect logs from each component, where that component keeps them at all. | Peoplevate Four-tier RBAC enforced on the API and the UI, with every mutation, sensitive read, download and export written to one audit log. |
| What does staying compliant cost? In licences, in engineering time, and in the next audit. | Cloud HR platforms A recurring subscription, typically sized per seat or per module, with compliance tooling spread across tiers. | Assembled open source Engineering time: integrate, harden, document — and keep all of it that way as each module moves. | Peoplevate Apache-2.0, with no per-seat licence and no paid tier holding back encryption, RBAC or the GDPR tooling. Your team contributes the operational effort instead — that is the trade. |
| Where each approach is the better fit Honestly, all three are the right answer somewhere. | Cloud HR platforms When zero operational burden matters more than where the data sits. | Assembled open source When you need to compose specific best-of-breed modules and have the engineering time to run them. | Peoplevate When data residency and provable handling are non-negotiable, and you are willing to operate the stack yourself. |
Three engineering decisions, all in the direction of being able to account for the record:
routes → services → Prisma, in strict-mode TypeScript.
AES-256-GCM encryption of PII and salary at rest, JWT with rotating refresh tokens, and RBAC enforced on both the API and the UI.
Every mutation, and every sensitive read, download or export, is written to the audit log.
A narrow fit is deliberate. If the second list describes you, one of the approaches above is the better choice — and it is better to know that now.
Why Peoplevate
Many open-source HR suites are assembled: separate modules, each with its own data model, access rules and upgrade path. Joining them up is one project; securing the result is another.
Peoplevate takes the opposite approach — the whole employee lifecycle in one data model, with compliance built in rather than bolted on.
Assembled modules
Integrated, configured and secured by you.
One data model
In the base system, not a paid tier.
The record, the access rules and the audit trail are one system, on your infrastructure — so “where is this data, and who has seen it?” has one answer.
One employee record, continuously, from job requisition → offer → onboarding → attendance, timesheets & leave → performance review → offboarding & settlement. Every stage is a workflow with an approval path and an audit trail, not a standalone table.
AES-256-GCM field encryption for PII and salary, GDPR data-subject rights with SLA tracking, retention policies with legal hold, a breach workflow with a 72-hour deadline, and consent evidence — in the base system, not a paid tier.
Four-tier RBAC (ADMIN / HR_MANAGER / MANAGER / EMPLOYEE) enforced on the API and the UI, with account lockout, argon2 password hashing and rotating refresh tokens with reuse detection.
Every create, update and delete is recorded — plus sensitive reads, downloads and exports — with anomaly detection for failed-login and bulk-download spikes. Salaries appear as [redacted] in the log, because plaintext is never stored.
Three containers, one docker compose up, migrations applied on start, persistent volumes and health checks on every service. No vendor and no multi-tenant data store — the database, the encrypted documents and the audit log stay on your infrastructure.
The employee record
Every stage is a workflow with an approval path and an audit trail — not a standalone table, and not something you have to reconstruct later. Select a stage to see what it holds.
Stage 01 · Recruit
Job requisitions, postings and a candidate pipeline, from application to offer letter.
Requisition
Candidate
Stage 02 · Onboard
Tasks for document submission, equipment assignment, orientation and system access setup.
No separate approval path in this stage — the tasks run against the same record, and each task completion is written to the audit log.
Stage 03 · Track time
Attendance, timesheets and leave, all against the same employee record as everything else.
Timesheet
Stage 04 · Review
Evaluation cycles for probation, mid-year and end-year, with a self → manager → HR workflow.
Review
Stage 05 · Offboard
Clearance checklists, exit interviews and a structured final settlement.
Offboarding
One funnel, one record, one data model — and every step lands on the audit log. Nothing is handed to a spreadsheet between stages.
A quick tour
Each one is part of the same record — the time data, the compliance queue, the audit log and the directory all read and write the same employee.
01
Weekly project × day grid, draft → submit → approve, with approval history and working-time reports.
| Project | Mon | Tue | Wed | Thu | Fri | Sat | Sun | Total |
|---|---|---|---|---|---|---|---|---|
| Atlas rollout | 8 | 7 | 8 | 6 | 4 | — | — | 33 |
| Support rota | 0 | 1 | 0 | 2 | 4 | — | — | 7 |
| Internal | 1 | 0 | 0 | 0 | 0 | — | 2 | 3 |
| Week total | 9 | 8 | 8 | 8 | 8 | — | 2 | 43 |
Approved by C. Sample · Mon–Sun week · daily cap 24h
02
GDPR access, erasure, portability and rectification requests tracked against a 30-day SLA.
| Type | Status | Received | SLA deadline | Days left |
|---|---|---|---|---|
| Access | In progress | 02 Sep | 02 Oct | 28 |
| Erasure | Queued | 09 Sep | 09 Oct | 21 |
| Portability | Completed | 21 Aug | 20 Sep | met |
| Rectification | In progress | 11 Sep | 11 Oct | 19 |
SLA tracking is part of the base system. Retention policies, legal hold, consent evidence and a 72-hour breach workflow sit alongside it.
03
An immutable record of every mutation, with before → after values and redacted salaries.
| Time | User | Action | Resource | Before | After | Status |
|---|---|---|---|---|---|---|
| 09:14:22 | A. Sample HR_MANAGER | UPDATE | employee.compensation | [redacted] | [redacted] | OK |
| 09:02:07 | B. Sample ADMIN | CREATE | document.contract | — | aes-gcm · v2 | OK |
| 08:47:51 | C. Sample MANAGER | APPROVE | timesheet.2026-W37 | SUBMITTED | APPROVED | OK |
| 08:31:09 | unknown — | LOGIN_FAILED | auth.session | — | attempt 4 of 5 | WARN |
| 08:12:40 | D. Sample HR_MANAGER | EXPORT | report.working_time | — | CSV · 412 rows | FLAGGED |
04
Hierarchical departments, positions, encrypted PII and employment-change history.
| Employee | Department | Position | Status |
|---|---|---|---|
| A. Sample | People Ops | HR Manager | Active |
| C. Sample | Engineering › Platform | Engineering Manager | Active |
| D. Sample | Finance | Payroll Analyst | On leave |
| B. Sample | Engineering › Data | Platform Engineer | Probation |
Security & compliance
Encryption, RBAC, audit logging and the GDPR tooling are part of the base system, not a paid tier.
Self-hosting
Three containers, one docker compose up, migrations applied on start, persistent volumes and health checks on every service.
Validated by zod at startup, which fails fast on invalid values. Secrets are enforced to be at least 32 characters and are never committed.
The recommended self-hosted stack
# 1. Configure environment (secrets are REQUIRED — >= 32 chars)
cp .env.docker.example .env
# edit .env: set POSTGRES_PASSWORD, JWT_SECRET, FIELD_ENCRYPTION_KEY
# 2. Build and start all three services
docker compose up -d --build
# 3. Verify — all services should report "healthy"
docker compose ps
curl http://localhost/healthz # frontend (Nginx)
docker compose exec backend wget -qO- http://127.0.0.1:4000/health # backend API
Run each app from source
# 1. Install dependencies
pnpm install
# 2. Configure environment
# Backend: copy .env.example -> .env (and .env.test)
# Required: DATABASE_URL, JWT_SECRET (>= 32 chars), FIELD_ENCRYPTION_KEY (>= 32 chars)
# Frontend: copy .env.example -> .env.local
# VITE_USE_MOCK=false enables the real API
# 3. Generate the Prisma client and create the schema
pnpm db:generate
pnpm db:migrate # or: pnpm db:push
# 4. (Optional) Seed sample data
pnpm db:seed
# 5. Run the development servers (backend :4000, frontend :5173)
pnpm dev
Modules
Core lifecycle and platform modules — each one reading and writing the same employee record, which is the point. This is the reference list.
01
Job requisitions with an approval workflow (draft → pending → approved → published → closed), postings, a candidate pipeline (APPLIED → SCREENING → INTERVIEW → OFFER → HIRED), interview scheduling and offer letters.
One funnel, one record — no spreadsheet hand-off.
02
Tasks for document submission, equipment assignment, orientation and system access setup.
New hires become productive and provably compliant from day one.
03
Clock in/out with IP capture and configurable grace minutes; a managed project & task catalog; weekly (Mon–Sun) timesheets with a 24-hour daily cap, manager approval and email notifications; leave types, policy groups, entitlements and balances with a multi-step manager → HR approval flow; and holiday calendars.
All time data in one place, with role-scoped reporting and CSV export.
04
Evaluation cycles (probation / mid-year / end-year) with a self → manager → HR review workflow and optional rebuttals.
05
Clearance checklists, exit interviews, settlements and a full offboarding state machine (INITIATED → CLEARANCE_IN_PROGRESS → EXIT_INTERVIEW → SETTLEMENT → CLOSED).
06
Hierarchical departments, positions and employees with manager relationships, plus employment-change tracking (promotion, transfer, manager change, salary adjustment, status change) with before/after history.
07
Typed documents (contract, national ID, passport, …) with AES-encrypted PII, expiry tracking and automated expiry alerts.
08
JWT + rotating refresh tokens, argon2 password hashing, account lockout, rate limiting, four-tier RBAC, full audit logging, and GDPR data-subject rights, retention policies and breach notification.
09
Scheduled jobs for document expiry, leave accrual, probation, deactivation, retention purge and DSAR SLA checks.
Architecture
No vendor and no multi-tenant data store — the database, the encrypted documents and the audit log stay on your infrastructure.
routes/ (HTTP + validation) → services/ (business logic) → config/prisma.ts, with co-located *.test.ts files.
index.ts (bootstrap, cron lifecycle, graceful shutdown) and app.ts (createApp(), used by the test suite).
UUID primary keys, snake_case columns, _at suffixes on timestamps and soft deletes via deleted_at.
Documentation & status
Four documents cover the modules, the role matrix, the REST API and production deployment.
01
All users, HR, managers, admins
How each functional module works, role-based workflows and frontend routes.
02
Admins, HR managers, operators
The RBAC role matrix and capability mapping across the system.
03
API consumers, integrators, developers
REST endpoint reference for the backend API.
04
Operators, DevOps, admins
Production deployment, including the recommended Docker Compose stack.
Questions
What it costs, what you have to run, and what happens if you ever want to leave.
Yes. It is licensed under Apache-2.0, so there is no per-seat fee and no paid tier holding back encryption, RBAC or the GDPR tooling. What you spend is the infrastructure you run it on and the engineering time to operate it.
Docker Engine 24+ with Docker Compose v2 is the recommended path: three containers, one docker compose up, and migrations applied on start. A local development setup needs Node.js 24, pnpm 11 and PostgreSQL 18.
Migrations run automatically when the backend starts, and data lives in named volumes that survive docker compose down. The deployment guide covers configuring, verifying, backing up, upgrading and hardening the stack.
There is no published bulk-import tool. The REST API and the database schema are documented, so an integration is possible — open an issue describing the system you are coming from, and the path can be worked out in the open.
Peoplevate is community-supported open source, with no contractual response time. Security reports follow the published security policy; everything else is best raised as a repository issue, so the answer stays public for the next team that asks.
The project is actively maintained. The v1 line covers the full employee lifecycle with security and GDPR tooling, and later releases have added timesheets with manager approval and working-time reports. Continuous integration and coverage both run in the open.
It stays yours. The database, the encrypted documents and the audit log live on your infrastructure, so there is no vendor to request an export from and no multi-tenant store to be locked out of.
Your team owns backups, upgrades and uptime. In exchange, no employee data leaves your infrastructure and every access decision is one you can inspect — which is the point of running it yourself.
Anything not covered here is best asked in the open — open an issue (opens in a new tab) and the answer stays public for the next team that asks.
Get started
Walk every workflow in the live demo without a backend, then deploy the full stack with three containers and one command. The database, the documents and the audit log stay on infrastructure you control.