The question the board of directors asks most often is "can a branch head see other people's salaries?". The table below gives quick answers for sensitive data types, based on Tanca's default configuration.
This table describes the default configuration. If your business has adjusted the matrix or granted individual permissions, open Settings › Permissions and cross-check — the actual configuration always overrides this table.
Sensitive data and who sees it
| Data type | Manager | Regional Manager | Branch Manager | Employee |
|---|---|---|---|---|
| Employee list | Yes | Yes | Yes | Own only |
| Employee phone numbers and emails | Yes | No | No | Own only |
| Salary / allowances in the profile | Yes | No | No | Own only |
| Employment contracts | Yes | View | View | Own only |
| Insurance records | Yes | View | View | Own only |
| Issued assets | Yes | View | View | Own only |
| Profile activity log | Yes | Yes | Yes | No |
| Export HR files | Yes | Yes | Yes | No |
"View" means they can open the list but cannot add, edit or delete. The Employee column says "Own only" because this group can only access that person's own data.
Three common misunderstandings
Regional Managers and Branch Managers can export files. These two groups cannot see salaries in profiles, but by default they still have the Export employee file, Export contract file and Export asset file permissions. If your internal policy prohibits taking HR data out of the system, you must turn off these Export rows.
The Manager group is not restricted by branch. Assigning this group to a branch head grants them permission to view the entire company, including salaries. Branch heads should be in the Branch Manager group.
Individual permissions are outside this table. A person in the Employee group can still see company-wide salaries if someone has enabled individual permissions in their profile. The table above does not reflect that — you must open each profile to find out.
How to check it yourself in five minutes
- Open Settings › Permissions › Permissions tab and select the HR module.
- Find the Salary/Allowances and View employee phone numbers and emails rows — confirm these two rows match your policy.
- Switch to the Payroll and Settings modules and review them the same way.
- Go to HR, filter by access group and check who is in the Manager group.
- For each person in the Manager group, ask yourself: does this person really need to see company-wide salaries?
Sample answer for the board of directors
"Under the current configuration, only the Manager group can see employees' salaries and contact information, consisting of N people: [list]. Branch heads are in the Branch Manager group, can only see the employee list of their own branch and cannot see salaries. All three manager groups can export files — if we need to tighten this, I will turn off the export permission within one day."
