Security & Compliance

Last updated: August 2026

At FunPayroll.com, we recognize that payroll, scheduling, and employee records are among the most sensitive data an organization possesses. Our platform is built on a security-first, enterprise-grade architecture designed to protect your data against unauthorized access, ensure continuous availability, and support your regulatory compliance efforts.

1. Data Encryption

We employ strong cryptographic standards to protect data at every stage of its lifecycle:

• In Transit: All communications between your browser, the mobile application, and our servers are encrypted using TLS 1.2 or TLS 1.3 protocols. We utilize strict HTTP Strict Transport Security (HSTS) to ensure unencrypted connections are never established.
• At Rest: Sensitive data stored within our Microsoft SQL Server databases—including compensation figures, identifying records, and system credentials—is encrypted at rest using AES-256 encryption.
• Credential Hashing: User passwords are never stored in plaintext. They are salted and hashed using modern, compute-intensive cryptographic algorithms before being committed to our database.

2. Architecture & Tenant Isolation

FunPayroll is built on a robust ASP.NET Core architecture designed for secure multi-tenancy. Each employer account operates within a strictly isolated logical data context. We enforce rigorous tenant-level separation at the application and database query tiers to guarantee that cross-tenant data access is mathematically and structurally prevented.

3. Identity & Access Management (IAM)

Access to the platform is governed by the principle of least privilege:

• Role-Based Access Control (RBAC): The platform enforces strict role hierarchies. Employees can only access their personal timecards and schedules. Managers can only view data for their assigned direct reports. Administrative functions are locked down to employer-designated personnel.
• Biometric Security: To comply with biometric privacy laws (such as BIPA), FunPayroll’s mobile application utilizes local biometric hardware (Face ID / Fingerprint) strictly as a localized convenience mechanism. No biometric templates are ever extracted, transmitted, or stored on FunPayroll servers.
• Internal Access: FunPayroll staff access to production infrastructure is heavily restricted, logged, and granted only on a temporary, as-needed basis for troubleshooting or maintenance.

4. High Availability & Disaster Recovery

We understand that payroll processing is a mission-critical operation. Our infrastructure is designed for high availability and rapid disaster recovery. Production databases are backed up continuously, with point-in-time recovery capabilities. Backups are encrypted and securely replicated to geographically redundant storage locations to protect against regional outages or catastrophic hardware failures.

5. Vulnerability Management & Secure Development

Security is integrated directly into our software development lifecycle (SDLC). We write and review code in accordance with OWASP Top 10 secure coding guidelines, heavily utilizing parameterized SQL queries and anti-forgery tokens to neutralize injection and cross-site request forgery (CSRF) attacks. Third-party dependencies and framework components are continuously monitored for CVEs (Common Vulnerabilities and Exposures) and patched promptly.

6. Regulatory Alignment

Our platform architecture and data handling practices are designed to assist employers in meeting their own compliance requirements, including:

• FLSA & Labor Laws: Providing immutable audit trails for time punches and geolocation verification to support Fair Labor Standards Act compliance.
• Privacy Frameworks: Operating as a designated "Service Provider" to support employer compliance with the CCPA/CPRA and other state-level privacy mandates.
• Security Best Practices: Aligning our internal security controls with the principles of the AICPA SOC 2 Trust Services Criteria (Security, Availability, and Confidentiality).

7. Incident Response & Responsible Disclosure

In the highly unlikely event of a confirmed data breach, FunPayroll maintains an incident response protocol that mandates prompt notification to affected employer administrators without undue delay, enabling them to fulfill their legal and regulatory notification obligations.

We welcome the collaboration of the cybersecurity research community. If you discover a potential security vulnerability in our platform, please practice responsible disclosure by emailing payroll@funpayroll.com. We request that you provide us a reasonable timeframe to investigate and remediate the issue before publicizing it.