One chart, one chain.
The org chart is built from the manager chain the server walks to decide who approves leave. A reorg cannot leave approvals pointing at somebody who left.
MomijiHRIS
The people system the other three sit on.
One directory. Time, Payroll, and Expenses all read it.
In most stacks this module is BambooHR. Here it is the same directory that runs the pay.
The ninety-day path.
Assign a template and a start date; the checklist lays itself across the first ninety days. The hire and their manager tick items off from their own screens.
Questions, already answered.
Active headcount, who is off this week, what waits on a decision, who starts soon. Managers see the same shape, narrowed to their own people.
Also built in
04
Setup by reading
Upload the org chart, the spreadsheet, last cycle's register. Momiji proposes the company; you confirm each row.
05
A setup that resumes
Progress lives on the server, not the tab. What is still missing prints as a list someone else can chase, and source files are deleted once read.
06
Self-routing time off
A request does the business-day math as it is typed, routes to the person's real manager, and approval deducts the balance in the same transaction.
07
Balances that accrue on their own
Each leave type gets a policy: a monthly accrual or an annual grant, mid-year hires prorated, carryover capped. The engine posts each one automatically.
Signed, sealed, provable.
Publish a document, assign it, and your team signs from a phone. Every signature binds to the document's fingerprint.
A directory is worth what it feeds.
The directory that also pays
Most stacks hand a CSV to a payroll vendor. Here they are the same records: onboard a person once and payroll prices them.
Privacy is a database boundary
A confidential employee is invisible to managers and every other admin alike, enforced in the database, not hidden in the interface.
Never collected, cannot leak
No SIN, no bank account. The columns were removed from the schema by decision, and the setup extractor strips anything resembling them.
Enforced in the database.
- 90day onboarding path
- 14day invite expiry
- 0SINs stored
- 1audit line per decision
The things people ask first.
What do I upload to get started?
Whatever exists: an org chart as an image or PDF, an employee list as a spreadsheet or photo, the handbook page naming vacation and sick days, last cycle's payroll register.
A frontier model reads each document server-side against a strict schema and proposes the structure; you confirm it before anything is created.
Anything unreadable stays honestly blank, because an honest blank beats an invented person.
Do time off balances accrue automatically?
Yes. Each leave type carries its own policy: a monthly accrual or an annual grant, mid-year hires prorated, and a carryover cap at the year boundary. A live preview writes that policy as a plain sentence about a real person before you save it.
The engine applies accruals automatically on a daily cycle, and brings any balance current the moment it is opened, so a balance is never stale. Every movement lands in an append-only ledger, each line a plain sentence with a running balance, the way a bank statement reads.
The arithmetic is floored at zero: no accrual, grant, or carryover forfeiture can drive a balance below zero.
Can we store and sign company documents?
Yes. Upload a policy, a contract, or the handbook as a versioned document, assign it to the people who need it, and they sign from a phone with a one-time signature they draw or photograph.
Each signature binds to the document's sha256 fingerprint, and the server re-hashes the exact bytes and re-verifies them against that fingerprint before it certifies, so a signature can never vouch for a document that has changed. The signed PDF carries a sealed certificate page: the Momiji seal, the signer, a UTC timestamp, the full fingerprint, and an audit trail, valid under Ontario's Electronic Commerce Act.
Signature images are readable by no one but the signer, not even the owner. That wall lives in the database and is proven by the test suite.
Who can see what someone earns?
Only the people the owner names. Salary and pay rate are revoked from the app's database role outright, released only through a call that records who read it, separate from admin and from payroll access.
Do you store SIN or banking details?
No. Momiji computes the pay and produces the stub; the money itself moves through your own bank.
Can a manager approve beyond direct reports?
Yes, at any depth. The reporting chain is walked on the server, and it governs what a manager can read as well as what they can decide.
What does "enforced in the database" actually mean?
Access rules live as row-level security in the database itself, not as checks in the app, so there is no code path around them.
References between companies are impossible by schema, every sensitive action lands in an append-only audit log that even admins cannot rewrite, and a suite of automated security tests runs against the production schema itself, re-proving the walls after every change.