Security & Data Protection

Encrypted at rest & in transit

All data encrypted at rest with AES-256. All client-server traffic over TLS 1.3. Database credentials and API secrets stored in a managed secrets vault, never in source.

Multi-tenant by construction

Every query is scoped by tenant_id. Postgres row-level security as belt-and-braces. No service account has blanket cross-tenant write access. Your data never leaks into another customer's tenant.

Immutable audit log

Every create, update or delete on an Employee, Contract, Pay Run, Leave transaction, Consent or Document is appended to an audit_event table that can only be written to — never updated, never deleted.

6-year retention by default

ERA s.45(3) and s.45(4) require 6-year retention of employment records. Every record within the window is read-only; edits are tracked, not overwritten. Retention windows can be extended per tenant policy.

Role-based access control

Admin, Payroll Processor, Payroll Approver, HR Officer, Finance, and Employee Self-Service roles are pre-defined. Granular permissions per module. SSO via M365 / Google Workspace optional.

Daily encrypted backups

Database snapshots daily, plus point-in-time recovery to within 5 minutes. Backups stored encrypted in an isolated region. Annual restore drills.

Signed e-documents

Every legally significant doc (contracts, probation extensions, dismissals, redundancy notices, consent forms) is signed via a SignatureConnector and returned with an audit certificate. No PDF is filed as "executed" without it.

No silent failures

Every validation failure raises a typed error and is logged. No "log and continue". A guardrail that lets a non-compliant pay run through is a bug, not a feature.

Cloud-grade infrastructure

Deployed on managed cloud infrastructure with 99.9% uptime SLA. Geographic redundancy. DDoS protection at the edge. Status page with real-time uptime and incident history.

Engineering principles

The non-negotiables behind every line of code.

These aren't aspirational — they're hard invariants. Any change that violates one is rejected.

ACID on money

Every pay run is one database transaction. Partial pay runs are not allowed. Either every employee gets paid correctly or nothing is committed.

Deterministic tax engine

Given the same inputs and the same rate table, the tax engine returns the same output bit-for-bit. No floating-point drift — money is computed in integer cents.

Rates are data, not code

PAYE bands, ACC bands, FNPF %, FNU Levy %, ACC %, redundancy exempt cap, Part 8 exemption threshold — all loaded from versioned rate_tables keyed by jurisdiction and year. Code reads from tables, never hard-codes numbers.

Single source of truth per employee

Employee identity lives in HRM. Payroll stores only the foreign key. The Payroll service mutating Employee master is an architectural rejection.

Event-driven handshake (HRM → Payroll)

HRM emits events (contract.signed, leave.approved, termination.executed, pay_rate.changed). Payroll subscribes via outbox pattern. No back-channel writes in either direction.

Least privilege

Role-based access. No service account has blanket write access to another service's tables. Every action is attributable to an authenticated user or service identity.

Your payroll data is the most sensitive data you own. We treat it that way.