Roles, security and audit trail
The right access for each team, and a record of everything they did
HR handles exits without touching purchase bills. Finance approves bills without editing assets. Your auditor reads everything and changes nothing. Every action, by anyone, lands in a log that nobody can edit.
- Seven roles
- Office-level access
- Audit log nobody can edit
Team
Who can do what
- Anita DesaiAll officesOwner
- Suresh PillaiBengaluru onlyIT Admin
- Farah KhanAll officesHR
- Rohit JainAll officesFinance
- Lakshmi R.Read-onlyAuditor
Example data
One shared login for the asset sheet
Everybody in IT and HR can edit the register, and nobody knows who changed the holder of LAP-0217 in March. When the statutory auditor asks for proof, all anyone can show is the latest version of the file.
Roles that match your teams
Owner: everything. IT Admin: inventory, hand-overs, transfers, issues and bills. HR: people, joiners, movers and leavers, and exit cases, with more rights the owner can switch on. Manager: their own team. Finance: approve bills and write-offs, see spend, but not change assets. Auditor: read-only, with an audit CSV. Employee: their own items.
- Owner, IT Admin, HR, Manager
- Finance without asset edits
- Read-only Auditor
- Extra HR rights by owner toggle
Limited to one office when needed
A role can apply everywhere or at one location. The Pune IT admin sees Pune’s assets and people; the owner sees every office.
- Any role, one office
- Or the whole company
- Changed any time
- Each company fully separate
Sign-in that is hard to misuse
Staff sign in with a password, or their work Google or Microsoft account, with owner controls over who may join. Two-factor sign-in asks for a code from an authenticator app, with one-time recovery codes. Passwords are stored with Argon2, sessions renew on their own, and a reused stolen session token is revoked.
- Google and Microsoft accounts
- Two-factor with an authenticator app
- Argon2 password storage
- Stolen sessions revoked
An audit log nobody can edit
Every change writes an audit event in the same step as the change itself, and the log cannot be edited or deleted. Signed documents and policy versions cannot be changed either; each carries a fingerprint, so tampering would be detected. Signing links work once, expire after 30 days and never appear in logs. Files are never public.
- Every change, who and when
- Cannot be edited or deleted
- Fingerprinted signed PDFs
- Files never public
Audit log
Every change, who and when
Cannot be edited or deleted
- 10:42Arjun Mehta signed hand-over ACK-2026-0412Signed PDF stored
- 10:15Suresh Pillai sent LAP-0217 for signatureBengaluru
- 09:58Rohit Jain approved bill BILL-0219, ₹2,36,000Finance
- 09:31Zoho People sync: Sneha Iyer marked as leavingExit case opened
Signed PDFs carry a fingerprint, so a changed file would show.
How it works
Three steps, no project plan
- 1
Invite your teams
Pick a role for each person, and an office where it helps.
- 2
Turn on two-factor
From Settings, with any authenticator app.
- 3
Give the auditor a seat
Read-only, with the audit log as CSV.
FAQ
Roles, security and audit trail: common questions
Can our statutory auditor get access?+
Yes. The Auditor role is read-only and can download the audit log as CSV.
Can anyone edit or delete the audit log?+
No. The audit log, signed documents and policy versions cannot be edited or deleted, by anyone, including the owner.
Do you support single sign-on?+
Staff can sign in with their work Google or Microsoft account, and the owner controls whether people from your domain may join on their own.
Is our data separate from other companies?+
Yes. Every request is checked against your company, and another company’s records are simply not found.
More of AssetVow
It all works from the same register
Employee asset tracking
Who holds every laptop, phone and monitor, across all your offices, kept current as people join, move and leave.
Learn moreDashboard, reports and depreciation
What needs attention today, what you spent this financial year, and the book value of every asset on any date.
Learn moreMicrosoft 365, Intune and Teams
Your Entra ID directory as the staff list, Intune devices matched to the register by serial number, and alerts in Teams channels.
Learn moreGive each team exactly what it needs
Invite IT, HR and finance with their own roles, and switch on two-factor. Free for 30 days.