Regulated on the outside. Tidy on the inside.
Branch staff across districts, collection agents on contract, a compliance team that wants to see every change. ZekoHR gives financial firms verified records, scoped roles and an audit log that answers the auditor, free for a year.
Up to 50 employees free for 12 months. No card, no sales call.
What auditors ask for, and where it usually is not
Employee KYC is a folder
PAN, Aadhaar, address proof, education and the background verification report sit in a shared drive with no version and no verifier. The Documents Center puts each in a category with a verification queue and a VERIFIED mark.
Who changed the salary?
A CTC edit in a spreadsheet leaves no trace. The audit log records every sensitive change with who, when and before-and-after values, and exports to CSV for the auditor.
Branches need their own HR view
A regional HR manager should see their branches and nothing else. HR scope narrows HR Managers to assigned companies; roles are enforced per permission on every request.
Controls you can show, not describe
Two-factor authentication that admins can enforce, roles and HR scope, encrypted identifiers masked in the interface, verified documents with expiry, and an exportable audit log. Data lives in Mumbai.
- Document verification queue, expiry reminders and request batches
- Audit log with before-and-after values, CSV export
- Roles, HR scope per company, admin-enforceable 2FA
- Payroll with pre-flight checks, TDS declarations and PDF payslips
Illustration of an audit log listing salary and document changes.
How financial firms roll it out
Lock down access
Set roles, assign HR scope per branch company, and enforce two-factor authentication for Admins and HR Managers before loading people.
Collect and verify
Raise document requests by company or department. Uploads enter the verification queue; HR verifies or rejects with a reason and the employee re-uploads.
Run payroll with evidence
Pre-flight checks flag missing attendance and unverified declarations. Finalise locks the run and generates payslips; rollback is audited.
When ZekoHR is not the right choice
You need SSO with your identity provider
ZekoHR has email and password login with 2FA and magic links. Single sign-on with Google Workspace or a SAML provider is not shipped yet.
You need incentive and commission calculation
Variable pay lines can be entered per run, but ZekoHR does not compute collection incentives or broking commissions from targets. That stays in your incentive tool; the number comes in as a line.
You need a product-level SOC 2 report today
Our parent company's ISMS is certified; the ZekoHR product audit is planned, not complete. The security page states exactly what is live.
Common questions
Can we restrict each regional HR to their own branches?
Yes. Make each region or branch cluster a company and assign HR scope so an HR Manager sees only their companies. Admins see the whole org.
Is the audit log good enough for an internal audit?
It records sensitive mutations with actor, timestamp, impersonation marker and before-and-after values, filters by actor and type, and exports to CSV. Platform-level actions are logged separately.
Are PAN and bank details encrypted?
PAN, UAN, ESIC and bank details are encrypted on write and masked in the interface. We do not claim whole-volume encryption at rest beyond what the security page states.
Can collection agents be contractors rather than employees?
Yes. Individual contractors and agency-supplied agents live in the Contractors module with an engagement, a reporting manager and only the access you choose.