Security
Payroll data deserves payroll-grade security
See docs/security.md in the repository for the full threat model and controls.
Role-based access control
Admin, Payroll Admin, Finance, HR, Manager, Employee and Auditor roles each see only what they need.
Data minimisation
Bank account and tax identifiers are masked by default and revealed only to explicitly authorised roles.
Full audit trail
Every payroll and employee change records who, what, when and why — nothing is silently overwritten.
Secure sessions
Signed, short-lived session tokens; passwords are hashed with scrypt and never logged or stored in plain text.
Deterministic payroll
AI explains and detects; it never computes or silently changes a final payroll amount.