Security is a shared responsibility between us, our hosting providers and our users. The full DPIA and Transfer Impact Assessment sit on the Trust Centre.
Transport and edge
- Every response is served over HTTPS and plain HTTP is redirected. Current browsers negotiate TLS 1.3; the minimum version accepted is our host’s setting, not ours. HSTS response header sends
max-age=63072000; includeSubDomains; preload(set invercel.jsonandsrc/middleware.ts). That is the header we send, not a claim that the domain is on the Chrome HSTS preload list. - Strict per-request Content-Security-Policy with nonce.
- Hosted on Vercel London edge (region lhr1) for UK requests.
Payslip handling
- Image processed in server memory only for the duration of the request.
- No payslip content written to any database, log, or file by PayslipIQ.
- EXIF metadata stripped client-side before upload.
- Uploads are rate-limited per IP: after three checks in an hour a Cloudflare Turnstile challenge is required, and a hard ceiling of thirty per hour per IP applies either way. A global daily cap on AI calls limits the blast radius of any single spike.
Identity and access
- Source code in private GitHub with branch protection and required review.
- Production secrets rotated quarterly.
Vulnerability disclosure
Email security@payslipiq.co.uk with the issue, the steps to reproduce it and how you would like to be contacted. Reports are acknowledged before any fix is scoped, and a critical issue is worked ahead of everything else on the site. We will not pursue good-faith researchers who avoid privacy violations, service disruption and data destruction, and public disclosure is welcome once the issue is fixed and the timing is agreed with you.
Certifications
PayslipIQ holds no security certification at present. Where a control is modelled on a standard rather than certified against it, we say so.
- Cyber Essentials Basic — Application in progress. Not yet awarded, and no award date is committed here, because the date an assessment completes is the certifying body’s to set rather than ours. This line will name the certificate number and the date of issue on the day one is issued.
- ISO/IEC 27001 — Not certified. Controls are modelled on Annex A, and certification is under evaluation rather than under way: no scope has been agreed and no auditor has been engaged. We are targeting a decision on whether to seek certification, once headcount justifies the scope by December 2027.
- SOC 2 — Not in scope for PayslipIQ, which is too small to be an audited service organisation. Our sub-processors maintain their own SOC 2 reports and release them directly to the parties they contract with; we are not licensed to pass a copy on. Ask us which sub-processor holds the report you need and we will tell you who to approach and for which report.
- Independent penetration testing — Intended annually, with a re-test after any material change to the data flow. No test has been completed and none is currently booked, so there is no report to share. This line will name the date and the tester of the first one.
- Internal review cadence — This Trust Centre, the DPIA and the Transfer Impact Assessment are reviewed quarterly. The dates of the last and next review are in the document control block at the foot of the Trust Centre.