BoltHR — HR & Payroll Platform

Overview

BoltHR is a multi-tenant HR management platform built by Backslash Lab and published on the App Store. It has three apps that share one backend. Employees and managers use the Expo mobile app for day-to-day self-service. HR teams run the organisation from a React web console. A Django REST API holds all of the business logic. One person can belong to several organisations and switch between them in the app.

Key Features

• Face-recognition attendance – Staff check in with a face-verified photo or a geofenced check-in, and team kiosks are run by supervisors. The server also runs liveness and anti-spoofing checks.
• Leave & approvals – Staff can apply for leave, check their balances and cancel requests, and someone can name a covering colleague. Approvals pass through configurable multi-step workflows, and managers can approve or reject from the phone.
• Payroll & payslips – The platform handles payroll cycles, salary runs, allowances, loans with repayment plans, and Maldives employee withholding tax (EWT).
• Rostering & shifts – Includes shift scheduling, open shifts and swaps, break policies, and overtime and shift-change requests.
• Employee lifecycle – Covers recruitment, onboarding, probation reviews, promotions and transfers, and offboarding with final settlements. HR letters are numbered from a register and can be e-signed.
• Enterprise integrations – Supports Microsoft Entra SSO, Teams status sync, ZKTeco and face-reader attendance devices, and Business Central.

Technical Highlights

• The mobile app is built with React Native and Expo (expo-router, TypeScript, TanStack Query, NativeWind) and is shipped with EAS Build. JS-only fixes go out as over-the-air updates.
• The API is built with Django 5 and Django REST Framework on MySQL. Rights and pages are stored as data, which drives role-based access control.
• Face recognition runs on the server with InsightFace and ONNX Runtime, and passive anti-spoofing sits in front of every punch.
• Security includes two-step verification (TOTP), read-only support impersonation with an audit trail, and PAdES e-signatures sealed with RFC 3161 timestamps.
• PostHog provides product analytics and session replay with sensitive data masked, and EAS Observe tracks startup performance and crashes.

My Role

Full-stack development across the Django API, the React admin console and the Expo mobile app, from data models and business rules to mobile UX and App Store releases.