SECURITY & DATA HANDLING
PaidReady holds the records behind your certified payroll. Here is how the product is built to protect them — in plain language, and specific enough to check.
The WH-347 needs an identifying number, not an SSN. PaidReady stores a customer-chosen worker identifier and rejects anything shaped like an SSN. There is no column for SSNs, dates of birth, bank details or identity documents, so they cannot leak from a system that never holds them.
Owner, admin, compliance manager, payroll manager, project manager and viewer roles map to explicit permissions. Gross pay, deductions and net pay are visible only to roles granted financial access; worker contact details are gated separately; project managers see only their assigned projects.
Every record belongs to one organisation. Foreign keys are composite with the organisation, so even a defective query cannot attach one company's record to another's. A foreign record is simply not found.
Sign-ins, invitations, signings, corrections, ReadyCheck runs and exception decisions are written to an audit log that has no update or delete path. Audit entries carry identifiers, statuses and hashes — never amounts, names, comments or raw files.
Signing binds a SHA-256 digest of the submission and the exact statement text to the signer, time, IP address and user agent. Signed PDFs are stored write-once with their hash. Corrections create a new record; the original is preserved.
ReadyCheck findings are never edited or deleted. Reviews append dispositions and comments; a corrected rerun resolves a finding by evidence, not by someone clicking 'compliant'.
Passwords are hashed with Argon2id. Sessions use short-lived HttpOnly cookies (15-minute access, 30-day refresh) with CSRF double-submit protection, and can be revoked on logout or password change. Signing a WH-347 requires re-entering your password.
An imported CSV is parsed, validated and committed as structured records. PaidReady keeps the filename, row count and file hash for traceability, not the file. Payroll data never goes into browser storage or URLs.
Registration, sign-in, invitation and reset endpoints are rate limited to slow credential attacks. Development-only conveniences are disabled in production; the service refuses to start with placeholder secrets.
Hosting. Production runs on Microsoft Azure in United States regions. Data is encrypted in transit (TLS) and at rest by the platform.
Backups. Database backups are taken automatically and restore is exercised as part of release checks. Signed PDF artifacts are stored separately from the database with their hashes verified on read.
Your data, your export. You can export your projects, workers, payroll records and signed PDFs at any time. After cancellation, records are retained for 90 days for export and then deleted.
Subprocessors. Cloud hosting (Microsoft Azure) and transactional email (Postmark). We do not sell data and do not use customer payroll data to train models.
Reporting a concern. Email security@paidready.com. We acknowledge within two business days and keep you informed until resolved.