Peoplevate v1.0.0 — Release

[orbivort]

---

Introduction

We are proud to announce the general availability of Peoplevate v1.0.0 — the initial
release of our self-hosted Employee Lifecycle Management System (ELMS).

This milestone marks the culmination of a spec-driven development program and delivers a
complete, workflow-enabled platform that spans the entire employee journey: from
recruitment and onboarding, through attendance & leave and performance
management, to offboarding. From day one, the platform ships with an
enterprise-grade security model and full GDPR compliance, closing every compliance gap
identified in the v1.0 Deployment Readiness Assessment.

Built on a modern, fully-tested monorepo and deployable with a single command via Docker,
Peoplevate v1.0.0 is ready for production self-hosting by organizations that require
complete control over their HR data.

---

Major Features

Full Lifecycle Coverage

End-to-end, workflow-enabled modules covering recruitment, onboarding, attendance & leave,
performance evaluation, and offboarding. Each module implements its business workflow as a
first-class state machine with role-aware transitions.

Enterprise-Grade Security

Security is architected in from the start, not retrofitted:

• argon2id password hashing
• JWT with 15-minute access tokens and 7-day rotating refresh tokens
• Token-family reuse detection and refresh-token hashing at rest
• Account lockout after 5 failed attempts (15-minute cooldown) plus login rate limiting
• AES-256-GCM field-level encryption with versioned key management
• Legacy SHA-256 decryption fallback for smooth key rotation

GDPR-Ready by Default

Full data-subject rights and retention tooling out of the box:

• Data subject access rights (access, erasure, portability, rectification) with SLA tracking
• Retention policies across eight data categories with hard-delete and anonymize actions
• 72-hour supervisory-authority breach notification workflow
• Consent management with evidence records and withdrawal links
• IP address data minimization (truncation) with configurable retention
• Anomaly detection for failed-login and bulk-download spikes

Four-Tier RBAC

A capability-based permission matrix (admin, HR manager, manager, employee) enforced
consistently on both the API and the frontend, scoping data access and actions
per role.

Modern, Accessible UI

A React 19 + Tailwind v4 interface built on Radix UI primitives, featuring responsive,
role-aware navigation, a comprehensive self-service area, and an accessible dashboard.

Docker Self-Hosting

A full docker compose stack (PostgreSQL 18 + backend + frontend via Nginx) enabling
one-command deployment with persistent volumes, health checks, and automatic migrations
on startup.

---

Enhancements

• Developer tooling baseline: ESLint flat config, Prettier, Vitest, and a CI workflow
  across a pnpm monorepo with shared config workspaces.
• Strict TypeScript baseline and a full unit + integration test suite as a quality gate.
• Employment change tracking with before/after value history for promotions, transfers,
  manager changes, salary adjustments, and status changes.
• Password lifecycle covering login, logout, forgot/reset, first-time setup, and
  change-password flows.
• Zod-validated environment configuration that fails fast on invalid settings.
• Graceful server shutdown with node-cron scheduled job lifecycle management.
• Document expiry tracking with severity-classified automated alerts.
• Automatic token refresh on 401 with a centralized session-expired handler in the SPA.
• Mock mode with a visible banner and MSW-based network interception for development.

---