Built to hold everyone's salary.

Payroll data is the most sensitive record most companies keep: what everyone earns, where it is paid, and who decided. Below is what Payro does about that, and at the end, what it does not yet do.

Tenant isolation, enforced below the code that uses it: Every request resolves your organisation from the URL and verifies membership before anything is read. Services never get a raw database client. They get one that forces your organisation onto every query for every tenant table. A request for another company's record returns a 404, not a permission error, because it should not even confirm the record exists.
Permissions checked on the server, every time: Roles carry a granular permission matrix, and the check happens on the server for every action, never by hiding a button. Owner, HR, finance, payroll officer, manager and employee each see a different payroll, and a manager's view is scoped to their own team.
Sensitive fields encrypted at rest: Bank account numbers, TINs and SSNIT numbers are encrypted with AES-256-GCM using a key held outside the database, and stored with only the last digits in the clear so a list can still be read without exposing the number.
Passwords hashed with scrypt: Sessions are server-side, with an idle timeout and an absolute maximum lifetime. Signing out invalidates the session on the server, not just in your browser.
An audit log that cannot be rewritten: Every sensitive action, from approving payroll and changing a salary to editing a statutory rule or exporting data, is recorded with who, what and when. The table rejects updates and deletes at the database level, through a trigger, so the log survives even a compromised application.
Payment data we never hold: Card details go straight to Paystack's hosted checkout; we store an authorisation token, encrypted, and never the card. Webhooks are verified by signature before they are believed.

History that stays true

Most payroll disputes are about a month that has already been paid. Payro is built so that month cannot quietly change.

Approved payroll is pinned: The statutory rule version used is recorded on the run and never re-resolved.
Employee data is snapshotted: A payslip keeps the salary, department and details that were true when it was produced.
Closed periods refuse recalculation: Reopening one is an owner-only action, and it is recorded.
Corrections go forward, not backward: An adjustment applies to a later period rather than silently rewriting a filed month.

What we don't claim

A security page that only lists strengths is marketing. These are the honest gaps.

We hold no third-party certification: No SOC 2 report, no ISO 27001 certificate, no completed external penetration test. When that changes we will publish the report date here rather than a badge.
Encryption keys rotate with a maintenance window: Rotating the field-encryption key currently requires a short window rather than a rolling migration. It is documented in our runbooks and on our list to improve.
Salary disbursement is not automated: Payro produces the bank and mobile money schedules; it does not move your money. No integration claims to, because none exists.

Reporting a vulnerability

If you find a security issue, tell us before you tell anyone else. We will confirm receipt, keep you updated while we fix it, and credit you if you want the credit.

Report an issue