How we protect your payroll data
Payroll is the most sensitive data most businesses hold — salaries, national ID numbers and bank details in one place. This page describes what we actually do about that, in plain terms.
What we do not claim
We do not hold ISO 27001, SOC 2 or any similar certification, and we do not claim to. What follows is a description of how the system is built, which you can weigh yourself — not a third-party attestation. Security is a shared responsibility: no system can be guaranteed, and we recommend you keep your own copies of critical records, as our Terms set out.
A separate database for every company
Each company workspace runs in its own dedicated database on its own subdomain. Your records are not rows in a shared table filtered by a company column — they are in a different database entirely. Isolation is the architecture rather than something enforced by a query someone could forget to write.
Sensitive fields encrypted at rest
National ID numbers and bank account numbers are encrypted in the database, so they are unreadable to anyone looking at raw storage or a backup file. Because encrypted values cannot be searched directly, we store a separate keyed fingerprint alongside them — that lets the app find an exact match without ever decrypting the column or storing the value in the clear.
Four separate sign-in realms
Operators, your own staff, your external clients and your employees authenticate through four completely separate authentication guards with separate accounts. A client signing in to view what you disclosed to them has no path into your internal workspace, and an employee viewing a payslip has no path into payroll administration.
Permissions down to the task
You control exactly what each person on your team can see and do. A data-entry coordinator can be given employee records without salaries, for example. Every administrative screen re-checks the permission on the action itself, not only when the page is opened.
An append-only audit trail
Sensitive changes are recorded to an audit log that is written once and never updated — the table has no modified timestamp because rows are not edited. A record of who changed what is only worth having if it cannot be quietly rewritten afterwards.
Support access is read-only and recorded
When we need to look at your workspace to help you, that access is read-only and audited. We can see what you see in order to answer a question; we cannot change your payroll while doing so.
Encrypted in transit, everywhere
Every page, including each company subdomain, is served over HTTPS with a trusted certificate, and plain HTTP is redirected. There is no unencrypted path to the application.
Automated off-site backups
Company databases are backed up automatically on a schedule and stored off the application server with a retention policy, so a failure of the machine running the app is not a failure of your data. Restores are exercised, not assumed.
We never hold your card details
Payment is by wire transfer, cheque or cash. There is no card processor in the product and no card number to store, lose or leak — the safest way to hold payment data is not to hold it.
The administrative console is not a public door
The operator console used to provision and support companies is not linked anywhere on this site, is reachable only at a private path, and signs an idle session out automatically. It is deliberately not discoverable.
Reporting a vulnerability
If you believe you have found a security issue, please get in touch and tell us what you found and how to reproduce it. We would much rather hear it from you than not hear it at all, and we will not pursue anyone who reports a genuine issue in good faith.
Payroll you can hand over with confidence
Request an account, or try the shared demo workspace first.
Request an account