Privacy Policy

PayrollPenguin turns payroll data you provide into certified-payroll filings — the federal WH-347 and state electronic formats — and flags anomalies for your review. To do that we hold some of the most sensitive data a business has: wage records and employee personal information. This policy explains, in plain terms, what we collect, where it lives, who else touches it, and how to remove it.

PayrollPenguin is a reporting and formatting tool. You review, certify, and file the reports it produces; this policy is about the data handling behind that, not a promise about the filings themselves.

PayrollPenguin is operated by Sully Ventures LLC, a New York limited liability company, which is the controller for the data described here.

Account data: your name, your login email, and a password (stored only as a hash by our authentication provider — we never see or store it in plain text).

Organization data: your organization’s name, team members and their roles, plan tier, and billing status. For CPA firms, the same for each managed client.

Payroll data you import: employee names, work classifications, hours worked (straight-time and overtime), gross pay, deductions, and fringe amounts — and, by default, only the last four digits of each employee’s Social Security number. Full Social Security numbers are covered in the next section.

Project and filing data: project names, contract numbers, awarding agencies, locations, the wage determinations that apply, the reports we generate, the anomalies we flag, and a record of who certified each report and when. Certification records are your audit trail, so we keep them with the same care as the filings.

Technical data: standard server logs (such as IP addresses) used for security and rate limiting. We do not use advertising trackers.

By default, PayrollPenguin stores no full Social Security numbers. Imports keep only the last four digits; the full number is never written to our database or file storage.

Two state filings (California eCPR and Washington PWIA) require a full SSN in the file. For those, you supply the number just-in-time at export: we validate it against the stored last four, use it in memory on our servers to build the file, record the access in an audit log (who, when, and for which report), and then discard it. It is never stored. The copies of finished filings we keep for your records are redacted to the last four digits.

An organization owner can explicitly opt in to encrypted at-rest SSN storage instead. That path uses column-level encryption with its own key, numbers are decrypted server-side only, and every decryption is logged. Turning the opt-in off purges the stored ciphertext and records the purge.

Your data is stored in a managed PostgreSQL database and file storage provided by Supabase; the application itself runs on Cloudflare. Data is encrypted in transit (TLS) and at rest.

Every organization’s rows are isolated with database row-level security — one customer cannot read another’s data, and we test that isolation. Generated files live in private storage scoped to your organization and are served only through short-lived signed links.

We use a small set of providers to run the service, and they process your data only to provide their service to us: Supabase (database, authentication, and file storage); Cloudflare (application hosting); Stripe (subscription billing — your card details go directly to Stripe, and we never store card numbers); Postmark (transactional email such as deadline reminders, when email sending is enabled); Intuit (QuickBooks payroll import, only if you connect a QuickBooks account — the connection tokens are stored encrypted); and Anthropic (an AI model that reads a document you upload, only to propose values for you to confirm).

We will update this list before adding a provider that handles customer data.

We use your data to run the service: transforming the payroll you import into filing formats, flagging anomalies for your review, tracking filing deadlines, handling billing, and answering support requests.

The computation that builds a filing is deterministic. When you upload a document, an AI model provider reads it for that request to propose values you review and confirm. PayrollPenguin does not store the uploaded document. The provider receives the document, which may contain a full Social Security number. From a document we keep only the last four digits of an SSN: any proposed value that looks like a full SSN (nine digits in a row, or in 3-2-4 groups) is dropped, and the evidence text we show is masked to the last four digits. Our provider terms prohibit training on these documents. Proposals you have not accepted can no longer be viewed or accepted after seven days and are deleted by a daily cleanup. Evidence text is cleared when you accept or reject a value.

We do not sell personal data, and we do not share it for advertising.

We keep your data while your account is active so your past filings, certifications, and audit trail stay available to you.

An organization owner can delete an organization’s data (or a CPA firm’s managed client) from the settings danger zone. The purge removes the database records and the stored files, and the deletion itself is recorded in a purge audit log. You can also email us to request deletion.

If a breach affects your private information and you live in New York, we will notify you as New York General Business Law § 899-aa (the SHIELD Act) requires — in the most expedient time possible and without unreasonable delay, and no later than 30 days after the breach is discovered, unless a law-enforcement agency determines that notice would impede a criminal investigation. Wherever you live, we will also notify you as other state and federal breach-notification law requires. Because we hold wage records and employee identifiers, we will also notify the affected organization owner so they can meet their own notification obligations.

If your payroll information is in PayrollPenguin, it is because a contractor (or their accountant) uses PayrollPenguin to prepare the certified-payroll reports that government agencies require on public works projects. We process that data on the contractor’s behalf. For questions or corrections about your information, start with your employer — we will assist them.

When this policy changes, we will update the effective date above, and for material changes we will notify account owners in the app or by email.

Questions about this policy or your data: privacy@payrollpenguin.com. Security questions and vulnerability reports: see our Security page.