06 · Security

Four questions, answerable for every rupee.

For any amount paid to any employee in any period, the system can say what it was, how it was computed, who authorised it, and what it would have been before the last change — without anyone opening a database.

Audit log
Appendonly
Recovery point objective
15min
Recovery time objective
4hrs
Data residency
India

Audit

Logging reads, not just writes.

Payroll is the highest-value data you hold, and the place where an internal fraud or an honest error costs the most. Auditability here is a functional requirement with acceptance criteria, not a logging concern delegated to infrastructure.

AUD-1

Immutable audit log

Every payroll-relevant change — structures, revisions, component definitions, statutory configuration, settings, bank details, tax declarations and verifications, loans, adjustments, run transitions, approvals, unlocks and payslip regeneration. Each entry records actor, role, timestamp, source, the record affected, before and after values, and the reason where one is required. No role can edit or delete an entry, including tenant administrators.
AUD-6

Access logging

Reads are logged too — who viewed whose salary, when, and through which surface, including exports and API calls. Bulk exports record the row count and the filter applied.
AUD-2

Configuration versioning

Every object that affects a calculation is versioned with an effective date. A run stores the configuration versions it used, so recomputing a period from two years ago returns exactly what was paid — not what today’s rules would produce.
AUD-3

Run version history

Each version retains its full output, and a comparison view diffs any two at employee and component level, showing which audit entries caused the difference. Superseded payslips stay retrievable, because an employee may be holding one.

Controls

Separations the system enforces.

Configurable, but on by default. Attempted violations are blocked and logged rather than warned about.

AUD-4

Maker is not checker

Whoever prepared a payroll run cannot be its sole approver.

AUD-4

Bank change cooling window

The user who changes a bank account cannot approve the run that pays into it within a defined window.

AUD-4

Create is not approve

The user who creates an employee cannot approve their salary structure.

SET-7

Compensation visibility

Roles carry an explicit scope — none, own team, own company, all — plus a masked mode that shows structure without amounts.

AUD-7

Auditor role

Read-only and scoped per company, so an external auditor sees one entity without touching anything.

AUD-8

Retention & legal hold

Deletion honoured only where no statutory retention applies, with a legal-hold flag that suspends deletion during a dispute.

Alerting

The events worth waking someone for.

Raised to a control owner independently of the approval chain, because the approval chain is exactly what a bad actor would route around.

  • A bank account changed within a set number of days before disbursement
  • A salary revision above a threshold you define
  • A payment released from hold
  • A run unlocked after approval
  • Statutory configuration edited
  • A bulk import touching more than a threshold number of employees
  • Any change to compensation data made through the API

The audit pack

One click assembles the payroll register, statutory summaries with their remittance references, the approval trail, every exception and override with its reason, the variance report, and the configuration versions in force. Statutory audit, internal audit and due diligence all ask for this set — and assembling it by hand is a week of work.

Platform

The boring guarantees.

Data residencyAll customer data stored in India.
EncryptionTLS in transit; encrypted at rest, with compensation and bank fields encrypted separately.
TestingOWASP Top 10 coverage and annual penetration testing.
Availability99.5% overall, with a stricter expectation during month-end processing windows.
RecoveryRPO 15 minutes, RTO 4 hours, with point-in-time restore across the statutory retention period — rehearsed, not assumed.
DurabilityAudit writes are synchronous with the change they record. A change that cannot be logged does not commit.
CorrectnessA statutory regression suite runs on every release; a failure blocks it.
NextPricing — what it costs
Continue →