Security & compliance
Built for the review, not for the demo
Two different people will interrogate this platform: an information security reviewer and a payroll auditor. This page is written for both of them.
157 statutory findings. All closed. 904 tests holding them closed.
A chartered-accountant-led payroll audit ran across thirteen waves against the live computation engine. It produced 157 findings — perquisite treatment, Section 89 relief, multi-state professional tax, Form-24Q correction flags, sandwich leave, gratuity by state. Every one is closed, and a 904-test regression suite locks the behaviour so a future release cannot quietly reopen them.
The CA-payroll audit referred to on this site was an internal quality exercise carried out for us against our own computation engine. It is not a certification, an assurance engagement, or an opinion addressed to you.
13
audit waves
157
findings raised
100%
findings closed
904
regression tests
Scope
What the audit actually covered
Thirteen waves against the live computation engine, not a document review.
Platform security
How isolation, sessions and permissions work
Specific enough that your security reviewer can disagree with it. That is the point — a page that only says 'enterprise-grade security' cannot be checked.
Multi-tenant isolation at the query layer
Every repository scopes reads and writes to the organisation. Tenant separation is enforced where the data is fetched, not by a filter in the interface that a crafted request could bypass.
Backend-for-frontend with httpOnly cookies
The browser never holds a token it can read. Sessions live in httpOnly cookies behind a BFF, with a CORS whitelist and account lockout on repeated failures.
Independent VAPT
A vulnerability assessment and penetration test was carried out on 17 March 2026. The report and its remediation status are available under NDA during a security review.
Role permissions across 30 modules and six actions
An explicit matrix rather than an implicit one, with field-level masking for salary and identity attributes, and workflow gates that block self-approval.
Immutable payslips and an access log
Payslips are hashed and snapshotted at approval. The access log records reads as well as writes, which is what an auditor asks for and what most platforms cannot produce.
Migration-driven schema evolution
Schema changes ship as versioned migrations, so the state of any environment is reproducible and reviewable rather than hand-applied.
Review pack
What we can put in front of your reviewer
Nothing here needs a signed contract first, other than the penetration test report.
CA-audit closure report
The 157 findings, their resolution and the migration each shipped in.
Penetration test report
Independent vulnerability assessment and penetration test carried out 17 March 2026, with remediation status.
Role and permission matrix
Thirty modules by six actions across the seeded roles, plus field-level masking rules.
Functional reference
Module-by-module behaviour, validation rules, scheduled jobs, error taxonomy and integrations.
Data processing and retention terms
What is held, for how long, and what an export contains on exit.
What we are not claiming
We do not hold ISO 27001 or SOC 2 certification today. What we have is an independent penetration test, a chartered-accountant-led payroll audit with a published closure position, and an architecture we will walk your reviewer through line by line. If a certificate is a procurement gate for you, tell us early rather than at contract stage.
Send us your questionnaireSend us your security questionnaire
We would rather answer it now than three weeks into a pilot. Send the questionnaire and the name of the reviewer, and we will come back with written answers and the evidence attached.