Lattice Look Enterprise

Built for the orgs your competitors can't onboard.

Five production HRIS connectors. Super-tenant multi-branch rollup. Custom subdomain branding. Per-tenant Stripe Billing. The compliance platform your CIO can actually deploy.

Book a Strategic Consultation View architecture
5
Production HRIS connectors
117
Workflows spec'd
506
Super-tenant tests
1,000+
API endpoints

Sprint 12 · Production-ready

Five HRIS connectors

Every Victorian council and most ASX-listed enterprises run one of these. We've built the integration so your team doesn't need to.

Chris21 / ichris

Frontier Software

Coverage

~40% of Victorian councils

Transport

SOAP Web Services + EAI delta

  • EAI change detection: only sync deltas, not full refreshes
  • Configurable page size with timeout guards (>30s triggers smaller-page retry)
  • GTR form enquiry (DET / POS / PDT / ORG / TER mapping)
  • AES-256 credential encryption at rest

TechnologyOne OneCouncil

TechnologyOne

BPA webhooks
Coverage

~35% of Victorian councils

Transport

REST/JSON + OAuth 2.0 Client Credentials

  • Council-specific configurable endpoints (TechOne admin sets up)
  • Inbound BPA webhook for near-real-time change detection
  • Redis token cache (no per-call OAuth round-trip)
  • Shareable PDF setup guide for the prospect's TechOne admin

Civica Authority Altitude

Civica

SmartGlue support
Coverage

~15% of Victorian councils

Transport

REST + OAuth 2.0

  • Two offboarding detection modes: STATUS_FIELD or MISSING_FROM_FULL
  • Symphony3 SmartGlue proxy support for councils on middleware
  • On-prem Authority fallback to CSV/SFTP
  • Quarantine queue for unreleased Civica offboarding API

SAP SuccessFactors / HCM

SAP

BTP path
Coverage

Larger councils, water authorities, ASX 100

Transport

OData + OAuth 2.0 SAML Bearer

  • SuccessFactors Employee Central entity sets (PerPersonal, EmpEmployment, EmpJob)
  • On-prem SAP HCM via SAP BTP Integration Suite
  • CSV/SFTP fallback when neither cloud nor BTP is feasible
  • Pre-seeded field mappings for Australian payroll

CSV / SFTP

Universal

Fallback
Coverage

100%, every org has at least this

Transport

SFTP deposit + column mapping wizard

  • Column mapping wizard: admins map their export, no dev required
  • Idempotent processing: same file twice = same state
  • Reconciliation report emailed after each sync
  • Quarantine of invalid rows (partial success, valid rows still process)

Setup guides for your HRIS admin

Six-page PDF playbooks tell your HRIS owner exactly what to provision: what fields to expose, what auth scope to grant, what endpoints to enable. Your IT lead doesn't need to learn our platform: they just forward the PDF. No credentials touch our team.

Available for all 5 connectors

One pipeline

Five connectors, one pipeline

Whichever HRIS you run, the data lands in the same normalisation layer. _process_employee_upsert() dispatches one of four paths and audits every change.

Celery Beat polls every 15 minutes (configurable per connector, 15–1,440 min). A daily health check sweep catches stale syncs, escalates consecutive failures to PLATFORM_ADMIN, and surfaces it on the council-level HRIS dashboard.

New employee → INSERT + auto-induction

CREATE

Triggers WF-22.2 (induction auto-create) the moment the row hits the database.

Diff vs hris_raw_snapshot → UPDATE + log

UPDATE

Position changes trigger WF-4.3 (delta induction). Field-level diff written to data_change_log.

TERMINATED / INACTIVE → soft-archive

ARCHIVE

Never hard-delete. Compliance evidence stays intact even after offboarding.

Identical state → SKIPPED

NO-OP

Idempotent. Replaying yesterday's sync produces yesterday's state, deterministically.

v6.0.0, shipped

Your tenant. Your subdomain. Your billing.

Hierarchical multi-tenancy with wildcard subdomain routing. State governments, multi-branch councils, and ASX 100 enterprises each get a real super-tenant, not a tag on a shared org.

Wildcard subdomain routing

Each council on {state}.latticelook.au, each enterprise on {brand}.latticelook.au. v6.0.13 redirects unknown subdomains to /404 cleanly.

Edge-layer middleware

Per-tenant branding

Custom logo, dashboard header, sidebar overlays, login page. Loaded dynamically from SuperTenantContext, no rebuild required.

v6.0.15 + v6.0.16 theming

Per-super-tenant SSO

OIDC per super-tenant. Your IdP, your scopes, your Fernet-encrypted client secrets. Provision SSO without sharing keys to our team.

v6.0.18, shipped 2026-04-12

Per-tenant Stripe Billing

Stripe subscriptions are scoped per super-tenant. Your finance team sees one customer, one invoice, regardless of how many branches roll up.

v6.0.0 baseline

506 dedicated tests guard the multi-tenant boundary. RLS bypass, MFA enforcement, and security hardening shipped in v6.0.22 (2026-04-23) and v6.0.23 (latest) keep that boundary tight.

Enterprise governance

What your CISO will ask about

Pre-answered. The same controls that satisfy Victorian state-government procurement satisfy yours.

AES-256-GCM credential encryption

HRIS credentials decrypted only inside the Celery worker, never at rest, never in logs.

Row-Level Security per tenant

Database-enforced isolation: even with admin access, queries cannot cross council boundaries.

Immutable audit trail

Every sync, field-level change, and mapping edit logged to data_change_log. 36-month retention.

Regulatory mappings shipped

Privacy Act IPP 1–5, VPDSF Mandatory 7, Public Records Act, Health Records Act, Frontier Software licensing.

MFA + per-tenant SSO

TOTP, WebAuthn passkeys, plus per-super-tenant OIDC for SSO into your IdP (v6.0.18).

Implementation scoped in your proposal

Configuration, data import, training, and HRIS and IdP integrations are scoped and priced in your proposal and statement of work. In writing in clause 3.9 of the Terms.

Ready to onboard?

30-minute consultation. The team that built the platform runs it, not a sales script. We'll scope HRIS connectors, super-tenant subdomain, dedicated CSM, and custom SLA in the same proposal.

Book a Strategic Consultation See pricing