Security
Built so one company's data cannot reach another.
We hold no certifications yet, so this page describes mechanisms rather than badges — the specific things the system does, which you can ask us about in detail.
Security mechanisms
Separated by company
Every record belongs to exactly one company, and reaching it requires an active membership of that company. One customer seeing another’s data is not prevented by a filter somebody might forget to apply — it is prevented by how the data is shaped.
Permissions checked on every request
Four roles — Owner, Workspace Admin, HR Admin, and Payroll/Finance Admin — each carrying a specific set of permissions. Every request is checked on the server. Hiding a button is presentation; refusing the request is security.
Separation of duties in payroll
Authorising payroll for payment is a different permission from running it, so the same person need not hold both. A company that wants a second pair of eyes can require one, and can forbid the person who processed a run from approving it.
Processed payroll cannot be edited
Once a run is processed its figures are frozen, and that is enforced by the database itself rather than by the absence of a button. Correcting it means an audited revert that returns it to draft — there is no path that quietly changes a frozen figure.
Payslips are versioned, not overwritten
Regenerating a payslip creates a new version and marks the old one superseded. The PDF an employee downloaded last month still exists, and still says what it said.
Payments cannot be double-recorded
Payment records are append-only, and each carries a reference that is unique per run. Sending the same one twice records one payment, not two — paying twice is the worst failure a payroll system can have, so it is prevented by a database constraint rather than by careful clicking.
Documents and payslips are private
Files are stored privately and there is no public link to any of them. Every download goes through a permission check first, so a URL that leaks is a URL that does not work for anyone else.
Changes are recorded
Actions in your company are written to your own audit log, and recent activity is shown on your dashboard. The audit trail for whoever operates the platform is a separate table from yours.
Who can see what
Four roles, and salary is deliberately not in all of them.
An HR administrator managing employees and leave does not need to see everybody’s bank details, and in TopexHR they do not. Payroll and salary sit behind their own permissions, held by the finance role.
The roles are fixed — you choose which one a person holds, and you cannot yet define a role of your own. That is a real limitation and it is on the roadmap rather than on this page as a feature.
Your data
Getting it out is part of the product.
Being able to leave is not a feature we would hold back to keep you. It is the thing that makes trusting us with payroll reasonable in the first place.
Export
Ask, and we export everything — every employee, salary structure, payroll run and document, as files rather than screenshots. Today this is something we run for you rather than a button you press, and we would rather describe it accurately than call it self-service.
Erasure
Ask us to delete your company’s data and we will, including the records behind it. The same applies to an individual’s data where the law gives them that right.
Backups that are tested
Backups are taken and then restored into a scratch database to prove they can be. A backup nobody has ever restored is an assumption, not a safety net.
The ordinary things, done
- HTTPS everywhere, with strict transport security
- A content security policy, and no third-party scripts on the application
- Rate limiting on sign-in, sign-up and password reset
- Sessions stored hashed, and revalidated on every request
- Passwords with a twelve-character minimum
- Soft deletion and append-only audit logs, so history is not destroyed by a click
What we don’t have
We do not hold SOC 2 or ISO 27001 certification today. We do not offer single sign-on or two-factor authentication yet. We do not publish an uptime guarantee, because we are not yet in a position to stand behind a number.
When any of that changes, it will say so here. This paragraph is what should make you believe the rest of the page.
Ready to simplify HR?
Create your company, add your people, and run a payroll this month. Fourteen days free, and no card to start.