Payroll data is the most sensitive data in an HR system. A leaked payroll causes more serious internal consequences than most other data incidents, and there is no way to take it back.
Three layers of control
| Layer | Where | What it controls |
|---|---|---|
| Access group | Settings › Permissions | Who can access the Payroll module |
| Template-level permissions | Payroll template › Permissions field | Who can view and edit each specific payroll |
| Branch scope | Payroll template › Branch field | The template only includes employees from the selected branches |
The second layer is the most important and is often left blank. For companies with multiple branches, the manager of branch A should not be able to view the payroll of branch B — specify this clearly in the Permissions field of each template.
Permission principles
- As few people as possible. Every account that can view the payroll is a point of risk. Review the list and ask about each person: does this person really need it?
- One account per person. Shared accounts completely undermine the value of the audit log.
- Separate view and edit permissions. Accountants need to view for reconciliation; not everyone who views needs to edit.
- Review every quarter, and immediately when someone changes departments or leaves the company.
Point 4 is the one most often forgotten. People who move from HR to another department often keep their old permissions for months because nobody remembers to remove them.
Audit log
Each pay period has an Audit Log tab that records who changed what and when. It is the investigation tool when something is suspicious, and the evidence when you need to provide an explanation.
- Review the log after each period, especially direct overwrites on the payroll.
- Every instance of unlocking an approved payroll should be reviewed.
- The log is only meaningful when each person uses their own account.
Security beyond the software
Most payroll data leaks don't happen inside the software but around it:
| Risk | How to reduce it |
|---|---|
| Exported payroll files left on personal computers | Require deletion after use; don't store them on shared computers |
| Sending payroll files via email or chat | Password-protect the file; better yet, don't send it and let those who need it view it in the system |
| Payroll screen left open when stepping away | Lock your screen; don't open the payroll where people pass by |
| Printing the payroll on paper | Minimize it; if you must print, dispose of it properly after use |
Publishing electronic payslips (article B9-12) in itself reduces risk compared to paper envelopes — each employee can only view their own payslip, and there are no printouts to lose.
What to tell employees
When switching to electronic payslips, employees will ask who in the company can see their pay. Answer before they ask, with an announcement that clearly states which groups have viewing access and why. A clear answer builds trust; silence breeds speculation.
