Security & Data Protection

Precision Payroll uses a custom, server-side session authentication system:

• Session tokens are 32-byte cryptographically random values generated using the Node.js crypto module
• Tokens are stored server-side as SHA-256 hashes — the raw token is never persisted in the database
• The session cookie is httpOnly, secure (in production), and uses sameSite: lax to prevent cross-site submission
• Standard sessions expire after 24 hours; “Remember me” sessions after 30 days
• Sessions are revoked on logout and on password reset
• Passwords are hashed using Argon2id via @node-rs/argon2 — never stored in plain text
• Google Sign-In is supported via OpenID Connect (Google Identity Services). Google account identifiers (sub) are stored, not raw credentials
• Timing-safe comparisons are used in login flows to prevent user-enumeration timing attacks

Every server-side request that reads or writes organization/employee/payroll data verifies:

• The userId is derived from the authenticated session — never trusted from the request body or URL
• The organization being accessed belongs to the authenticated user (single-owner model)
• The employee being accessed belongs to the same organization
• The saved calculation record being read/modified belongs to the user's organization

These checks prevent cross-organization data access — a user in Organization A cannot read or write records belonging to Organization B, even with a valid session and a manually crafted request.

Precision Payroll is served over HTTPS with TLS in production deployments. Security response headers are configured including Content-Security Policy (CSP), to reduce exposure to common web vulnerabilities.

Payroll and employee data is treated as sensitive business information:

• Salary figures, PF balances and FnF settlement data are stored in the database only when a user explicitly saves a record
• Production server logs do not record complete salary payloads — only identifiers (record ID, organization ID, tool type) are logged for diagnostics
• Anonymous use of public calculators involves minimal server-side data retention beyond standard HTTP logs
• PAN, UAN and bank details entered in employee records are stored in the database and visible only to the authenticated organization owner

The application uses a PostgreSQL database accessed through a Prisma ORM layer. At a high level:

• The database is not directly exposed to the internet
• Database credentials are managed as environment variables, not hardcoded
• All queries are parameterized through the ORM — raw SQL injection vectors are not present in normal application flows
• Soft-delete patterns are used for user-facing records (saved calculations, salary slips) to support data recovery

Precision Payroll runs on cloud infrastructure. Specific provider details are not disclosed publicly. Infrastructure security practices include environment-based secret management and separation of development and production environments.

If Precision Payroll becomes aware of a security incident affecting user data, we will investigate promptly and, where required by applicable law, notify affected users and authorities within the required timeframe.

For security concerns, contact: security@precisionpayroll.app

If you have discovered a potential security vulnerability in Precision Payroll, please report it responsibly before public disclosure:

• Email: security@precisionpayroll.app
• Include a clear description of the issue, affected component and steps to reproduce
• We aim to acknowledge reports within 5 business days and provide an initial assessment

We ask that you do not publicly disclose the vulnerability until we have had a reasonable opportunity to investigate and address it. We do not currently operate a formal bug-bounty programme.