Security and privacy
Employee identities. Pay records. Tax documents. Here is how the payroll API handles access and sensitive information today — and where we draw the line on what we claim.
Controls in the code
The payroll API encrypts Social Insurance Numbers using AES-256-GCM. Normal employee responses show only a mask and the last three digits. A full SIN reveal is a separate, permission-checked flow requiring a verified mobile number and a one-time text code; it refuses to reveal if SMS is not configured.
Supported-year T4 XML downloads include full SINs. That route requires payroll processing permission, a separate administrator-only SIN-export capability and recent authentication. It refuses impersonated requests and unavailable tax-year layouts before decrypting SINs.
Authenticated firm requests carry a Firebase identity token that the API verifies. Role permissions and per-member permission settings control permitted actions on the server, not just which buttons appear in the browser. Sensitive actions have their own permission checks.
The API derives the active organization from verified membership, not from an organization ID submitted with a payroll record. Tenant-scoped queries filter records by organization; client restrictions further narrow access for members assigned to specific client companies.
Audited changes record the action, actor and affected record, with before-and-after details where applicable. Sensitive fields such as SINs and credentials are redacted from change details. The SIN-reveal flow records the reveal without putting the SIN in the audit entry.
The access-code employee portal uses a signed, expiring token tied to an employee and organization. Its responses select the fields needed for pay statements, tax documents and the employee profile, rather than returning complete internal database records. The profile shows a masked SIN.
Platform administrators have a separate, audited view-as-firm path. It is read-only by default; writes require a time-limited signed grant. The SIN-reveal and T4 XML-export routes refuse impersonated requests.
An important distinction
Organization and client access checks run in the API. An additional PostgreSQL row-level-security backstop exists in the code, but is default off. We do not present that optional database layer as an active protection.
Oh My Payroll is preparing for launch. This page describes implemented controls, not a certification, an independent security assessment or a guarantee that a system can never have a vulnerability.
Read the Privacy page for a short summary of how personal information is handled. The full Oh My HQ Privacy policy and Terms of service apply to Oh My Payroll and are linked from those pages.
For a privacy request or a question about these controls, write to info@ohmyhq.com. Please do not include SINs, passwords or payroll files in your first message.
Other support and legal contactsJoin the Payroll waitlist for news about access. No account or payment required.
Join the waitlist