Security & Privacy at Canadian Payroll

Sign-in uses email and password through our managed auth provider. Passwords are checked against the Have I Been Pwned database at sign-up and password change to block known-compromised credentials. New account creation is currently paused; existing users can still sign in.

Canadian Payroll runs on a managed cloud platform with a secure database, encrypted file storage, and serverless server functions. Traffic to the app is served over HTTPS.

To run payroll, Canadian Payroll stores the business profile, employee records, pay runs, pay stubs, generated letters, and Records of Employment that you create in the app. Uploaded company logos are kept in a private storage bucket and served via short-lived signed URLs.

Each workspace's data is scoped to the signed-in account through row-level security policies in the database. Server-side functions re-validate the caller's session before reading or writing data, so one account cannot see another account's payroll records.

Canadian Payroll relies on a managed cloud provider for hosting, auth, database, storage, and server functions to operate the service. Calculations are based on the Canada Revenue Agency's published T4127 payroll formulas; Canadian Payroll is not affiliated with the CRA, and you should verify remittances independently before filing.

Records you create (employees, pay stubs, letters, ROEs) are retained while your account is active so you can reference them for year-end and CRA filings. To request deletion of your account or specific records, contact us using the address below.

If you believe you've found a security vulnerability, please reach out through our contact page so we can investigate. Please avoid testing against real payroll data belonging to other customers.