Security and data protection

What we want: two payroll exports without names — the annual export for the previous year and the current payroll state: job title, gender, pay for work (base and variable), paid hours, length of experience, region, weekly hours.

What we do not want: names, personal ID numbers, account numbers, addresses, sick leave, union dues, health data. If they are in the export, the system discards them on import and lists what it discarded. We work with pseudonymised rows — not anonymous data, and we treat them accordingly.

What goes into the language model: the list of job titles and the names and descriptions of job groups. No pay, no gender, no personal identifier. The model computes no number; code places the figures into the documents after the model has answered. We do not claim that nothing is stored by the model provider; we claim that what could be stored is a list of job titles.

Who decides: every proposal is confirmed by a person on your side. Nothing is merged or redacted silently. Every confirmation, change and undo is recorded with a name and time in a trail that cannot be edited or deleted at the database level.

Separation of companies: each company's data is separated by row-level rules in the database; a test that tries to read another company's rows must fail.

Deletion: payroll rows are deleted once you take over the outputs, within 30 days at the latest. The evidence pack contains no individual salaries. At the end of the contract the trail leaves with you.

Contract before data: a data processing agreement (Art. 28 GDPR) is signed before any file is handed over. You are the controller, we are the processor.

Infrastructure: the target infrastructure is European (Germany). The exact list of providers (sub-processors) will be published here before live operation. Whether personal data is transferred to a third country is assessed in the data processing agreement — our assessment, not a guarantee.

This website uses no tracking cookies or advertising scripts. Forms store only what you type, in an EU database, for 12 months or until withdrawal. Details: Privacy policy.