The problem with HR software, line by line.

Every price is on one public page, adjusted to your country.

There is no quote and no sales call. The pricing page lists the plan and shows that every module is included, in two flat currency books, US dollars and Indian rupees, each set for its market rather than converted from the other. Any change is announced and dated in public, not sprung on you at renewal.

The complete core is on every plan, including the free one.

The whole core HRIS, people, leave, attendance, onboarding, documents, workflows, self-service and reports, is identical on every plan and free for up to 20 people. Two things change when you pay: the twenty-employee limit goes away, and all fourteen modules become available, included in the plan at no extra charge rather than core features held hostage. Beyond that, no plan gate is live in the product at all. Even the workspace activity log is on every plan, filterable and exportable by your own admin, because an audit trail you have to buy is not an audit trail. Nothing in the core is ever moved behind a plan wall to force an upgrade.

Every entitlement and every access decision comes from a rule you can read, not a model guess.

Leave entitlements, access decisions, approval routing and generated letters are deterministic: the result comes from a rule you can audit, never a model guess. Payroll numbers are not ours to guess at either, for a different reason: Capstan computes no statutory pay at all. It compiles the inputs and hands them to your payroll partner, who computes the result, and Capstan holds no rate, slab or formula anywhere. No personal or sensitive record is ever sent to a third-party AI model or used to train one. One optional assistant, opt-in per workspace, answers a user's own question from aggregate figures they could already see and sends those to OpenAI, our one AI sub-processor, which does not train on the data. And no AI scores, ranks or screens your people, no attrition ratings, no sentiment analysis, no algorithmic candidate ranking, by documented product decision.

Employees and contractors in one directory, across countries and currencies.

One directory, one org chart and one set of documents for employees and contractors alike. Leave understands that Berlin and Bengaluru are different places, equity is something your people can watch vest, and payroll inputs are compiled and handed to your local partner rather than re-keyed.

One-click export in open formats, any time, even on the way out.

Export everything in one click, on the day you leave and on any day before it. A late invoice does not lock you out: the term enters a thirty-day grace period and access is uninterrupted, with reminders sixty days out, thirty days out, on the due date, and five days before the door actually closes. Only after thirty days past due is the workspace suspended, and not one row of your data is touched when it happens. Export keeps working throughout, because the export endpoints deliberately sit outside the billing check. Reinstating is a person here recording that your payment arrived, never an automatic penalty. Deletion is a cryptographic erase: destroying the keys that decrypt your workspace makes the data unreadable even from a backup, and a residue scan proves nothing survives outside statutory records.

Support has no standing access, and the database cannot read a salary without a key it does not hold.

Support staff belong to no tenant, so the database denies them your records by default. Helping with a ticket needs a consent you grant, time-boxed and scoped, with sensitive fields masked and every read logged on both sides. Sensitive fields are encrypted with a key that lives only in the application service, so a database dump is ciphertext.