The problem with HR software, line by line.

Every price is on one public page, adjusted to your country.

There is no quote and no sales call. The pricing page lists every plan and every module, and the numbers are adjusted to your country’s purchasing power, so a team in Lagos or Jakarta is not asked to pay a New York rate. Any change is announced and dated in public, not sprung on you at renewal.

The complete core is on every plan, including the free one.

The whole core HRIS, people, leave, attendance, onboarding, documents, workflows, self-service and reports, is identical on every plan and free for up to 20 people. Two things change when you pay: the twenty-employee limit goes away, and you become able to enable paid modules, which are separate add-ons with genuine marginal cost rather than core features held hostage. Beyond those two, no plan gate is live in the product at all. Even the workspace activity log is on every plan, filterable and exportable by your own admin, because an audit trail you have to buy is not an audit trail. Nothing in the core is ever moved behind a plan wall to force an upgrade.

Every entitlement and every access decision comes from a rule you can read, not a model guess.

Leave entitlements, access decisions, approval routing and generated letters are deterministic: the result comes from a rule you can audit, never a model guess. Payroll numbers are not ours to guess at either, for a different reason: Capstan computes no statutory pay at all. It compiles the inputs and hands them to your payroll partner, who computes the result, and Capstan holds no rate, slab or formula anywhere. Your people data is never sent to a third-party AI model and never used to train one. And no AI scores, ranks or screens your people, no attrition ratings, no sentiment analysis, no algorithmic candidate ranking, by documented product decision. Optional assistance we may add at the edges, such as search or drafting, stays opt-in and never touches this system of record.

One-click export in open formats, any time, even on the way out.

Export everything in one click, on the day you leave and on any day before it. A late invoice does not lock you out: the term enters a thirty-day grace period and access is uninterrupted, with reminders sixty days out, thirty days out, on the due date, and five days before the door actually closes. Only after thirty days past due is the workspace suspended, and not one row of your data is touched when it happens. Export keeps working throughout, because the export endpoints deliberately sit outside the billing check. Reinstating is a person here recording that your payment arrived, never an automatic penalty. Deletion is a cryptographic erase: destroying the keys that decrypt your workspace makes the data unreadable even from a backup, and a residue scan proves nothing survives outside statutory records.

Support has no standing access, and the database cannot read a salary without a key it does not hold.

Support staff belong to no tenant, so the database denies them your records by default. Helping with a ticket needs a consent you grant, time-boxed and scoped, with sensitive fields masked and every read logged on both sides. Sensitive fields are encrypted with a key that lives only in the application service, so a database dump is ciphertext.

Employees and contractors in one directory, across countries and currencies.

One directory, one org chart and one set of documents for employees and contractors alike. Leave understands that Berlin and Bengaluru are different places, equity is something your people can watch vest, and payroll inputs are compiled and handed to your local partner rather than re-keyed.