One chart, one chain.
The org chart is built from the manager chain the server walks to decide who approves leave. A reorg cannot leave approvals pointing at somebody who left.
MomijiHRIS
The people system the other four sit on.
One directory. Time, Expenses, Payroll and Comply all read it.
In most stacks this module is BambooHR. Here it is the same directory that runs the pay.
The ninety-day path.
Assign a template and a start date; the checklist lays itself across the first ninety days. The hire and their manager tick items off from their own screens.
Questions, already answered.
Active headcount, who is off this week, what waits on a decision, who starts soon. Managers see the same shape, narrowed to their own people.
Also built in
04
Setup by reading
Upload the org chart, the staff list, last cycle's register. Momiji proposes the company; you confirm each row. A clean spreadsheet skips the model entirely: map its columns once and the rows are staged as they are.
05
A setup that resumes
Progress lives on the server, not the tab. What is still missing prints as a list someone else can chase, and source files are deleted once read.
06
Self-routing time off
A request does the business-day math as it is typed, routes to the person's real manager, and approval deducts the balance in the same transaction.
07
Balances that accrue on their own
Each leave type gets a policy: a monthly accrual or an annual grant, mid-year hires prorated, carryover capped. The engine posts each one automatically, every night. Any balance opens into a statement that shows every day behind it, the accruals and the time taken in one running total.
Signed, sealed, provable.
Publish a document, assign it, and your team signs from a phone. Every signature binds to the document's fingerprint.
Required training
The record, kept as it happens.
Health and safety training is a record somebody has to produce on the day it is asked for. It runs on this same directory, so the person, the site and the rule are already the same records, and it is included in every plan, Budget upwards.
A rule that assigns itself, courses built from your own documents, four ways for a person to finish one, a completion nobody can edit afterwards, one board across every location, and one evidence pack when somebody asks to see it. That is MomijiComply, and it has a page of its own.
A directory is worth what it feeds.
The directory that also pays
Most stacks hand a CSV to a payroll vendor. Here they are the same records: onboard a person once and payroll prices them.
Privacy is a database boundary
A confidential employee is invisible to managers and every other admin alike, enforced in the database, not hidden in the interface.
Collected only where you ask for it
No SIN, ever: the column was removed from the schema by decision, and the setup extractor strips anything resembling one. A bank account is held only if you turn direct deposit on, entered by the employee, encrypted, and readable by the account owner alone.
Enforced in the database.
- 90day onboarding path
- 14day invite expiry
- 0SINs stored
- 1audit line per decision
The things people ask first.
What do I upload to get started?
Whatever exists: an org chart as an image or PDF, an employee list as a spreadsheet or photo, the handbook page naming vacation and sick days, last cycle's payroll register.
A frontier model reads each document server-side against a strict schema and proposes the structure; you confirm it before anything is created.
A clean spreadsheet, CSV or Excel with one row per person, takes a different door: you map each column onto a Momiji field, salary included, and no model reads it.
Anything unreadable stays honestly blank, because an honest blank beats an invented person.
Do time off balances accrue automatically?
Yes. Each leave type carries its own policy: a monthly accrual or an annual grant, mid-year hires prorated, and a carryover cap at the year boundary. A live preview writes that policy as a plain sentence about a real person before you save it.
The engine applies accruals automatically on a daily cycle, and brings any balance current the moment it is opened, so a balance is never stale. Every movement lands in an append-only ledger, each line a plain sentence with a running balance, the way a bank statement reads.
The arithmetic is floored at zero: no accrual, grant, or carryover forfeiture can drive a balance below zero.
Can we store and sign company documents?
Yes. Upload a policy, a contract, or the handbook as a versioned document, assign it to the people who need it, and they sign from a phone with a one-time signature they draw or photograph.
Each signature binds to the document's sha256 fingerprint, and the server re-hashes the exact bytes and re-verifies them against that fingerprint before it certifies, so a signature can never vouch for a document that has changed. The signed PDF carries a sealed certificate page: the Momiji seal, the signer, a UTC timestamp, the full fingerprint, and an audit trail, valid under Ontario's Electronic Commerce Act.
Signature images are readable by no one but the signer, not even the owner. That wall lives in the database and is proven by the test suite.
Who can see what someone earns?
Only the people the owner names. Salary and pay rate are revoked from the app's database role outright, released only through a call that records who read it, separate from admin and from payroll access.
Do you store SIN or banking details?
A SIN, no. It is keyed in at the moment a T4 is generated and never written to a database field.
Banking details, only if you turn direct deposit on, which is off by default. Then each employee enters their own account on the web and it is stored as ciphertext under a key held outside the database, readable by the account owner alone and never without an audit line. Leave it off and Momiji computes the pay and produces the stub while the money moves through your own bank against a wire sheet.
Can a manager approve beyond direct reports?
Yes, at any depth. The reporting chain is walked on the server, and it governs what a manager can read as well as what they can decide.
A person who runs a location rather than a reporting line gets the same authority a different way: everyone posted at a site they manage is theirs, alongside everyone who reports to them. It points down and sideways, never up, so putting somebody in charge of a floor never hands them their own manager's record. The alternative most systems leave you with is reparenting the whole floor under them, which is a lie about who reports to whom, or making them an org admin, which hands them every other location as well.
I own two companies. Can I see them together?
Yes, as a private lens rather than a merger. Put the companies you own into a group and headcount, hours, overtime, labour cost and payroll cost line up beside each other, month by month, with a total.
A group grants nothing. No employee is shared, no pay run is shared, and no query reads two companies at once: each company answers its own question, as its own owner, and the answers are added up on your screen. Only somebody who owns every company in the group can make one or see it, and there are no intercompany eliminations, because this is addition, not consolidation.
How do we keep track of required health and safety training?
In MomijiComply, which runs on this directory and is included in every plan, Budget upwards. Write a rule in plain language and it assigns itself: a course, who it covers, how many days after hire it is due, and how many months until it lapses.
Each completion is append-only and carries the course version, the evidence, and a sha256 of the whole record, so what you show somebody a year later is the same record that was written on the day. One board holds every location against every rule, and any figure with somebody behind it opens their names.
The module has a page of its own, which answers what it will refuse, who can see a signed record, and why it never says you are compliant.
What does "enforced in the database" actually mean?
Access rules live as row-level security in the database itself, not as checks in the app, so there is no code path around them.
References between companies are impossible by schema, every sensitive action lands in an append-only audit log that even admins cannot rewrite, and a suite of automated security tests runs against the production schema itself, re-proving the walls after every change.