How we protect your payroll and participant data

• ✓The PayEzy application runs on servers in Sydney, Australia.
• ✓All traffic is encrypted with HTTPS, and browsers are told to always use it.
• ✓The connection between the application and its database is encrypted.
• ✓Tax file numbers, bank account details and payroll reports sent to the ATO are also encrypted field by field with AES-256-GCM before they’re stored.

• ✓Every account sets up an authenticator app for multi-factor sign-in when it’s activated.
• ✓Passwords are stored only as bcrypt hashes, never in readable form.
• ✓Repeated failed sign-ins are rate-limited and locked out for a period.

Every record belongs to one organisation, and the organisation is taken from the signed-in user’s session, never from what the browser sends. Within an organisation, each person only sees the areas their role allows, and support workers only see their own shifts and payslips.

Changes to shifts, pay runs and settings are written to an audit log. Each entry’s hash includes the one before it, so editing or deleting a past entry breaks the chain and can be detected.