Security Overview
Current application safeguards and the operational controls required before live payroll launch.
Identity and access
- Native email verification before account activation; no Microsoft or Google login.
- Salted, memory-hard password hashes; passwords are never stored in readable form.
- Hashed one-time and session tokens, secure HTTP-only cookies, rate limits, lockouts, and origin validation.
- Tenant membership and role permission checks are enforced on the server for every protected operation.
Data and provider boundaries
- Every payroll-domain record carries a tenant identifier and provider resource lookups are re-scoped to that tenant.
- Provider secrets are server-side only and production infrastructure stores configured secrets in a managed vault.
- Sensitive payroll onboarding is delegated to hosted provider components where available.
- Live payroll money movement and live Stripe billing have separate disabled-by-default activation switches.
Audit, resilience, and response
Authentication, membership, organization, payroll, billing, provider webhooks, policy acceptance, and ledger sync create auditable records appropriate to their risk. Provider webhooks are verified and deduplicated. Backups, restore tests, alerting, retention, incident contacts, vulnerability management, and access reviews must be documented and exercised before production payroll.
Reporting
Report suspected vulnerabilities or account compromise to security@zentropayroll.com without accessing other users’ data, disrupting service, or publicly disclosing an unremediated issue. Provision and monitor this mailbox before launch. We will acknowledge valid reports and coordinate remediation and disclosure based on severity and legal duties.