The identity layer that runs team operations
The hub is the ROIkeep application the other three sign in against: one account per person, by invite, reaches all four. It also runs team operations: attendance, employee profiles, asset and key tracking, and announcements.
[ 01 ]
Single sign-on
One account per person signs in to every connected application, by invite only.
A person is added once and reaches every application; access is granted and removed in one place.
- The hub is the identity provider the other three applications sign in against.
- Each person holds one account as owner, admin, or member, and can hold a different role in each application.
- Joining is by invite only. There is no open sign-up.
- Role and department ship inside the sign-on token, so a connected application needs no user table of its own.
- One account signs in to all four applications, and to nothing outside ROIkeep.
Access assigned per application
A person's per-app roles, granted and cleared from the hub console.
Leaving closes every door
When someone leaves, removing them bans them from every connected app, ends their active sessions, and writes an audit entry.
[ 02 ]
Employee profiles
The HR record behind each account, kept in the same place as the login.
The paperwork behind each person is attached to their account, and edits to it are recorded.
- Personal, employment, and emergency contact details sit alongside department and job title.
- CNIC, salary, bank account, and IBAN are encrypted at rest with AES-256-GCM.
- ID scans, the offer letter, the contract, and police verification attach to the person.
- A stored change history records which fields changed and when.
One record per person
A profile with employment details and its attached documents.
[ 03 ]
Attendance
Daily clock in and clock out, with location and hours rules per person.
Who worked, from where, and for how long is recorded without chasing anyone.
- Clocking in and out requires browser coordinates, resolved against configured geofences.
- Activity outside every geofence is recorded and flagged as a location mismatch rather than blocked.
- Each person works under fixed or fluid hours, with per-day schedule exceptions.
- Sessions left open past the cycle boundary are closed automatically.
- Admins see a daily and a monthly team view, and open any member's history.
Clock in with location
A clock-in resolving against a configured geofence.
[ 04 ]
Asset and key tracking
Which office key and which device is with which person right now.
Company property has a named holder, and company computers have a trust state.
- Keys sit in a two-level location tree with a photo each, and assigning one shows its current holder.
- Computers, phones, tablets, watches, and peripherals record ownership with serial number, asset tag, IMEI, and MAC addresses.
- Archived devices stay as read-only history.
- Enrolled Windows and Linux computers report a signed hardware baseline, and drift quarantines the computer until a new baseline is approved.
A computer's trust state
An enrolled computer's baseline, drift, and last-seen record.
[ 05 ]
Credentials vault
Encrypted storage for the credentials, environment values, and notes a team has to share.
Shared credentials sit in one encrypted place with named access, instead of chat messages and spreadsheets.
- A vault holds credentials, environment variables, and secure notes.
- A vault owner shares it with named people as read, or as read and write.
- A pasted .env file splits into names and values, shows what will be created, and copies back out as one block.
- A single secret goes to one person with an expiry, without giving them the vault, and the sender sees whether it was collected.
- The Bitwarden import shows exactly what will be created before anything is written.
One secret, one person, one expiry
A one-time handoff showing whether it was collected.
How the values are held
Every vault value is hidden until revealed and encrypted at rest with AES-256-GCM. Secret values are never written to any log. A one-time handoff is destroyed the moment it is opened or revoked, and unreadable the moment it expires.
Read how security works[ 06 ]
Announcements
Internal notices from admins to everyone or to named people, with read tracking.
A notice is sent once, and who has read it is visible.
- An announcement goes to everyone or to named people, and choosing a department expands it into named recipients.
- Read and unread are tracked per person, with an unread count and a banner feed.
- Web push reaches the devices that opted in.
Sent once, tracked per person
An announcement with its read and unread state per recipient.
Members, sign-on, and access for Command and Control, Lead Central, and Expense Tracker come from the hub.
The hub is not a separately sold module: every plan ships all four applications.