Security
Security is the product, not a feature page.
Payroll data is the most sensitive data most small businesses hold. PayrollGrove is built by Shield Management, a managed security and hosting provider, and designed so that your data stays encrypted, access stays visible, and money never moves without you.
Access log · Maya Chen
Visible to Maya- LF
Lena Fischer · Admin
Revealed SSN (Step-up · 2FA)
Nov 18, 10:02 AM
- JA
Jordan Avery · Payroll admin
Viewed bank account (Masked ••••6789)
Nov 17, 4:15 PM
- NA
Northwind Accounting · Partner · Accountant
Downloaded pay stub (Partner access)
Nov 16, 9:30 AM
Controls
Defense in depth, explained plainly.
Encryption
- SSNs, TINs, bank account and routing numbers, FEINs and I-9 data are encrypted per field with AES-256-GCM
- Each company has its own data key, wrapped by a key-encryption key that never lives in environment variables, images or backups
- Generated files (pay stubs, tax forms, NACHA files, exports) are encrypted per file with authenticated streaming encryption
- TLS 1.2+ everywhere, HSTS preloaded, strict security headers
Authentication
- Two-factor authentication (TOTP) is mandatory for every admin, payroll and partner role
- A fresh code is required to approve payroll, download NACHA files, reveal restricted data and change bank details
- Passwords of 12+ characters, strength-checked and screened against known breaches
- Sessions bound to the app host with HttpOnly, Secure cookies, idle timeouts and new-device alerts
Least privilege
- Restricted fields are masked by default; revealing one needs permission plus step-up, and is rate-limited
- Role-based access with department, location and manager scopes
- Separation of duties so the preparer can’t approve their own payroll
- Partner staff are scoped per client, and every switch into a client is logged
Audit & transparency
- Every change, approval, sign-in and sensitive view is written to the audit log in the same transaction
- Audit rows are hashed and sealed into a chain, verified daily for tampering
- Every employee can see an access log of who viewed or revealed their restricted data
- Every view of an I-9 record is audited, as federal rules require
Payroll fraud
Built against direct-deposit diversion.
The most common payroll attack is an account takeover followed by a bank-account change just before payday. PayrollGrove layers controls against it.
- 1
Step-up
Any bank add or change needs a fresh two-factor code (or an emailed one-time code for employee-only users).
- 2
Cooling-off
New accounts wait 3 days by default. Until then pay goes to the previous account, or by check.
- 3
Out-of-band alerts
The employee’s work and personal email are notified, and payroll approvers get an in-app alert.
- 4
Contact-change lock
A bank change within 24 hours of an email or phone change is blocked.
- 5
Preflight
Payroll flags any account changed within 7 days of the check date.
Infrastructure
US-hosted on infrastructure we operate.
No multi-tenant SaaS sprawl: PayrollGrove runs on servers Shield Management manages in the United States, with a short, published subprocessor list.
Hardened hosts
Key-only SSH from restricted networks, host firewall, intrusion detection and file-integrity monitoring, automatic security updates.
Tenant isolation
Every tenant table is protected by Postgres row-level security in addition to application authorization, and tested continuously.
Point-in-time recovery
Continuous encrypted WAL archiving to a local and an offsite repository, plus nightly encrypted logical backups.
Restore drills
Automated monthly restores to a random point in time, with integrity and audit-chain checks, and a quarterly full disaster-recovery drill.
No trackers
No analytics, ad pixels or third-party error trackers in the app or on this website.
Secure SDLC
Protected main branch, reviewed merge requests, secret scanning, static analysis, dependency and container scanning on every change.
Support access
Our staff can’t see your data unless you say so.
There is no standing staff access to customer data, and no impersonation.
- Support requests access with a reason and a scope
- A company owner or admin approves it in-app with step-up
- Access expires within 72 hours and can be revoked at any time
- Everything staff do under a grant is in your audit log
Compliance
Working toward SOC 2.
Our controls are mapped to the SOC 2 Trust Services Criteria. We are targeting a SOC 2 Type I report within six months of launch, and an external penetration test within 60 days of launch.
- Written security program
- Quarterly access reviews
- Incident response plan
- Vendor management
- Data retention schedule
Responsible disclosure
If you believe you’ve found a security vulnerability in PayrollGrove, please email us. We’ll acknowledge your report within two business days, keep you updated, and credit you if you wish. Please don’t access other customers’ data, degrade the service, or run automated scanners against production without permission.
In scope
payrollgrove.com and app.payrollgrove.com
Please include
Affected URL, steps to reproduce, impact, and your contact details.
Safe harbor
We consider good-faith research that follows this policy to be authorized.
Payroll your security team will sign off on.
30-day free trial, no card required. Then $39/mo + $7 per employee. Month to month, everything included.