Security & data handling

Built for the most sensitive data you hand us.

Certified payroll means trusting a tool with Social Security numbers and wage data — some of the most sensitive information a person has. We treat it that way. Here is exactly what we do with it, in plain terms, and exactly where we are on formal certification.

Join the waitlist

Where we stand on SOC 2

We are not SOC 2 certified, and you won’t see a badge here implying we are. SOC 2 is a third-party audit conducted over a period of months; as an early-stage product, we haven’t completed one. What we have done is engineer to those same control objectives from the start — and we’ll publish a dated attestation here the day we complete an examination. Until then, the controls are listed below.

What we actually do

By default, we never store full Social Security numbers

Imports keep only the last four digits — the full number is never written to our database or file storage. For the two state filings that embed a full SSN (California eCPR and Washington PWIA), you supply it just-in-time at export: it’s validated against the stored last four, used in memory on the server to build the file, logged as an access, and discarded. The copies of finished filings we keep are redacted to the last four. Encrypted at-rest storage exists only as an explicit opt-in that an organization owner must turn on — and that path uses column-level encryption with its own key in a managed secrets vault, decrypted server-side only.

SSNs are masked everywhere you work

Throughout the app you see only the last four digits (***-**-1234). The full number is never fetched for display — only the two state filings that require a full SSN (California eCPR and Washington PWIA) ever assemble it, and that happens server-side, in memory, at export.

Every use of a full SSN is logged

When a full number is used for a filing — whether you supplied it just-in-time at export or an owner opted in to encrypted storage — we record who, when, why, and for which report. The log row is written in the same step as the access, so the audit trail can’t drift from what actually happened.

Your data is walled off from every other tenant

Row-level security runs on every table that holds customer data, scoped to your organization. One customer cannot read another’s rows — not through the app, not through the API. We test cross-tenant isolation explicitly, and a failing isolation test blocks a release.

Connected payroll tokens are encrypted too

When you connect QuickBooks, the access tokens are encrypted with a separate key from the SSN key, so the two never share a blast radius. Tokens are decrypted server-side only, never exposed to the browser.

Finished files are private and links expire

Generated WH-347s and state files live in private storage scoped to your organization. They’re served only through short-lived signed links that expire in about a minute — there are no public file URLs anywhere in the product, and a build check enforces that.

The filing path is deterministic — no AI, no guessing

The engine that builds your filing does no machine learning and makes no outside network calls. It reformats your own numbers to each official spec and flags anomalies for your review. A narrow, checkable path is a smaller thing to secure — and it’s why the output is the same every time.

You can have your data deleted

An organization owner can purge a client’s data — the database records and the stored files both — with the deletion itself recorded for your records. Your data is yours; you can take it back.

Questions a security team asks

Are you SOC 2 certified?
Not yet, and we won’t claim otherwise. PayrollPenguin is an early-stage product, and a SOC 2 report is a formal third-party audit over a period of months that we have not completed. What we have done is build to those control objectives from day one — full SSNs never stored by default, tenant isolation tested on every release, audit logging, a deterministic filing path — and we’re happy to walk a security team through exactly how each one works. When we complete a SOC 2 examination, we’ll say so here and date it.
Where is my data hosted?
On Supabase (managed Postgres, authentication, and file storage) and Cloudflare (application hosting), both of which maintain their own SOC 2 Type II attestations as our infrastructure providers. Data is encrypted in transit (TLS) everywhere and at rest, with connected-account tokens carrying the additional column-level encryption described above. Full SSNs aren’t stored at all unless an organization owner explicitly opts in to encrypted storage.
Who can see the full Social Security numbers?
By default, no one — because we don’t have it. PayrollPenguin stores only the last four digits; the full number is never shown in the app and never written to our database or file storage. It exists on our servers only in memory, only while building the two state filings (California eCPR and Washington PWIA) whose agencies require it: you type it in at export, we validate it against the stored last four, log the access, put it in the file you download, and discard it. The filing copies we keep are redacted to the last four. If an organization owner explicitly opts in to storing SSNs, they’re held column-level encrypted and every decryption is logged.
Can I get a copy of your security documentation for a vendor review?
Yes. If your customer, your CPA firm, or a general contractor sends a vendor-security questionnaire, email security@payrollpenguin.com and we’ll return a completed security overview that maps our controls to the standard questionnaire categories. We’d rather answer the real questions than point at a badge.

Reporting a vulnerability

If you believe you’ve found a security issue, email security@payrollpenguin.com. We read every report, we won’t pursue good-faith researchers who follow responsible disclosure, and we’ll keep you posted on the fix.

Running a vendor review? Read the Terms or email us for a completed security overview. PayrollPenguin is a reporting and formatting tool — not a compliance guarantor or legal advisor.