Security & Data Protection

Encrypted at rest & in transit

All data encrypted at rest with AES-256. All client-server traffic over TLS 1.3. Database credentials and API secrets stored in a managed secrets vault, never in source.

Multi-tenant by construction

Every query is scoped by tenant_id. Postgres row-level security as belt-and-braces. No service account has blanket cross-tenant write access. Your data never leaks into another customer's tenant.

Immutable audit log

Every create, update or delete on an Employee, Contract, Pay Run, Leave transaction, Consent or Document is appended to an audit_event table that can only be written to — never updated, never deleted.

7-year retention by default

ERA s.45(3) and s.45(4) require 7-year retention of employment records. Every record within the window is read-only; edits are tracked, not overwritten. Retention windows can be extended per tenant policy.

Role-based access control

Nine predefined roles — Payroll Admin, Processor and Approver, HR Manager and Officer, Auditor, OHS Officer and Employee Self-Service — each with granular per-module permissions. Multi-factor authentication (TOTP) is enforced for administrators.

Backups & point-in-time recovery

The database is hosted in AWS Sydney with point-in-time recovery (RPO in minutes). Independent encrypted backups run daily to two separate providers and regions — Backblaze B2 and Cloudflare R2 — with 30-day and 12-month retention and automated restore verification.

Signed e-documents

Every legally significant doc (contracts, probation extensions, dismissals, redundancy notices, consent forms) is signed via a SignatureConnector and returned with an audit certificate. No PDF is filed as "executed" without it.

No silent failures

Every validation failure raises a typed error and is logged. No "log and continue". A guardrail that lets a non-compliant pay run through is a bug, not a feature.

Hardened, monitored infrastructure

A hardened nginx gateway with a web-application firewall (ModSecurity + OWASP Core Rule Set), rate limiting, TLS 1.3 and HSTS. Live uptime and incident history are published on our status page.

Architecture & data residency

Where your data lives — and where it doesn't.

A breach of our application server would expose no payroll records. Here's why.

Data in AWS Sydney

All customer data — including uploaded documents, stored as bytes in the database, not on server disk — lives in a managed PostgreSQL database in AWS's Sydney region, encrypted at rest by the platform.

Stateless application tier

The application server runs code only — it holds no customer data at rest. Compromising the app host exposes no employee, payroll or document records.

Secrets out of source

Database credentials and API keys live in server configuration, never in source control. The off-site backup bundle is client-side encrypted (GPG / AES-256) — a leaked backup token is not live access.

Engineering principles

The non-negotiables behind every line of code.

These aren't aspirational — they're hard invariants. Any change that violates one is rejected.

ACID on money

Every pay run is one database transaction. Partial pay runs are not allowed. Either every employee gets paid correctly or nothing is committed.

Deterministic tax engine

Given the same inputs and the same rate table, the tax engine returns the same output bit-for-bit. No floating-point drift — money is computed in integer cents.

Rates are data, not code

PAYE bands, ACC bands, FNPF %, FNU Levy %, ACC %, redundancy exempt cap, Part 8 exemption threshold — all loaded from versioned rate_tables keyed by jurisdiction and year. Code reads from tables, never hard-codes numbers.

Single source of truth per employee

Employee identity lives in HRM. Payroll stores only the foreign key. The Payroll service mutating Employee master is an architectural rejection.

Event-driven handshake (HRM → Payroll)

HRM emits events (contract.signed, leave.approved, termination.executed, pay_rate.changed). Payroll subscribes via outbox pattern. No back-channel writes in either direction.

Least privilege

Role-based access. No service account has blanket write access to another service's tables. Every action is attributable to an authenticated user or service identity.

Assurance

What we hold today — and what's on the roadmap.

We'd rather state this plainly than imply a certificate we don't yet hold.

✓ In place today

AES-256 encryption at rest; TLS 1.3 + HSTS in transit
Tenant isolation with PostgreSQL row-level security
Append-only, immutable audit logging
Multi-factor authentication (TOTP) enforced for admins
Web-application firewall (ModSecurity + OWASP CRS) + rate limiting
Daily dual-region encrypted backups + point-in-time recovery
Independent security review, findings remediated
7-year records retention (ERA s.45)

→ On the roadmap

SOC 2 — readiness programme underway; audit timeline available on request
Independent penetration test — being scheduled with CREST-accredited firms
ISO 27001 — assessment under consideration
SSO / SAML — planned for enterprise customers

No SOC 2, ISO 27001 or completed third-party penetration test is claimed today. i-Tavi Pay is operated by Pro Accountants, a Fiji chartered accounting practice and Registered Tax Agent that runs its own payroll on the platform.

Your payroll data is the most sensitive data you own. We treat it that way.