Security and data protection

A payroll file is among the most sensitive data a company holds. This page describes how we work with it.

What we need from you

Two payroll exports without names: the annual export for the previous year and a current payroll snapshot. From them we take the job title, gender, pay for work (base and variable components), paid hours, length of experience, region and weekly hours.

We do not need names, personal ID numbers, account numbers, addresses, sick leave, union dues or health data. If they are in the export, the system removes them on import and lists what it removed and why. We work with pseudonymised rows. They are not anonymous data and we treat them accordingly.

What goes into the language model

The language model receives the list of job titles and the names and descriptions of job groups. No pay figure, no gender and no personal identifier leaves our database. The model proposes the grouping and the rating and drafts the texts. The calculations are done by code, which also places the figures into the documents after the model has answered. The model therefore cannot change a figure in a document that serves as evidence.

The model provider may store the request. In that case, only the list of job titles would be stored.

Who decides

Every proposal (job groups, ratings, borderline cases) is confirmed by a person on your side. Nothing is merged or hidden without your knowledge. Every confirmation, change and reversal is recorded with a name and a time in a record that cannot be edited or deleted at the database level.

Separation of companies

Each company's data is separated in the database by row-level rules: under one company's identity, another company's rows cannot be read. This is part of our automated tests. A test that tries to read another company's data must fail.

When we delete

Payroll rows are deleted once you have received the outputs, within 30 days of handover at the latest. Data from individual years is not accumulated. The evidence pack you receive contains no individual salaries; a named list for pay adjustments is produced only on explicit request and is marked as a file containing personal data. At the end of the contract, the record of decisions is yours to keep. It is your evidence.

Contract before data

Before any file is handed over, we sign a data processing agreement (Art. 28 GDPR). You are the controller, we are the processor. Whether you need a data protection impact assessment (DPIA) is your decision as controller; we provide the material for it.

Infrastructure

The target infrastructure is European (Germany). The exact list of providers (sub-processors), their registered offices and regions will be published on this page before the first data transfer. Whether personal data is transferred to a third country is assessed in the data processing agreement.

This website

This website uses no tracking cookies or advertising scripts. Details: Privacy policy.