Security, POPIA and the audit trail
How your data is isolated, logged and protected.
Tenant isolation
Every payroll table is protected by row-level security in the database. A request that is not tied to an authenticated member of the company returns nothing — the interface is not the security boundary.
Audit trail
Creations, changes, approvals, deletions, exports and logins are recorded with the user, timestamp and context. The audit log is searchable and exportable, and cannot be edited from the application.
POPIA
Payroll Africa is built around POPIA principles: collect only what is needed, restrict access by role, log disclosures, and support data subject requests. Employees can see what is held about them through self-service.
Sensitive data handling
Bank account numbers are masked on documents and interfaces by default. OAuth tokens and API keys are stored server-side and are never returned to the browser. Payment card details never touch Payroll Africa — they are handled by the payment provider.
Your responsibilities
Use unique, strong passwords, remove leavers from your team promptly, and review the audit log periodically. Never email a spreadsheet of employee banking details.
