Your clients’ data, protected at every layer
Payroll data is sensitive. We treat it that way — with encryption, strict access controls, and tenant data isolation built into every part of the platform.
Security built in, not bolted on
Every feature is designed with data protection at its core — from the database layer up to the user interface.
Data Encryption
All data is encrypted in transit using TLS 1.2+ and at rest using AES-256. Every connection is served over HTTPS, enforced by strict transport security. Your clients’ payslips and personal data are protected end to end.
Tenant Isolation
Every bureau’s data is logically isolated. Access controls scope every request to your organisation, and database-level row-level security policies provide a second layer of defence — so your data stays yours.
Access Control
Strong password requirements, email verification, and company-email enforcement at registration. Sessions are secured with automatically rotating tokens, and you decide who sees what through role-based permissions — with the ability to deactivate a user and revoke their access instantly.
Audit Trail
Every change to client records, payroll configurations and settings is logged — who changed what, and when. If HMRC ever asks, you’ll have the answer in seconds.
Infrastructure & Backups
Hosted on enterprise-grade cloud infrastructure with encrypted, redundant daily backups and a recovery procedure we’ve tested with a live restore drill. Your data can be recovered quickly if the unexpected happens.
API & Request Protection
Requests to your data are authenticated and rate-limited. Cross-site request forgery protection guards every data-changing request. Webhook signatures are verified cryptographically. Disposable and personal email addresses are blocked at registration.
How we stay ahead of threats
- Automated dependency vulnerability scanning on every dependency change, plus a scheduled weekly security audit
- Content Security Policy, HSTS and clickjacking protection headers on every response
- Source code never exposed to end users — source maps removed in production
- Secrets managed via encrypted environment variables — never hardcoded
- Structured application logging with automated alerting on background-job failures
- Rate limiting on authentication and sensitive data endpoints
- Regular code reviews with security as a first-class concern
- Backup and restore procedures documented and tested with a live recovery drill
A personal guarantee
I built The Pay Bureau because I run a payroll bureau myself. My own clients’ data runs on this platform every day. I wouldn’t trust it with their information if I wasn’t confident in every layer of protection we’ve built.
If you ever have a concern about the security of your data, I want to hear about it personally.
— Minhaz Moosa, Founder, The Pay Bureau
Have a security question? We respond within 24 hours — support@thepaybureau.com