Security and support

Payroll data contains sensitive personal and financial information. Only collect and send the payroll information PayrollKit needs for the capabilities you use.

Protect access

• Request PayrollKit access tokens and call the PayrollKit API from your server. Never expose your OAuth client secret or access token in browser code, URLs, analytics or logs.
• Store OAuth client secrets and webhook signing secrets in a secret manager.
• Use the standard OAuth client for your main integration. Give a service that performs only part of the workflow a narrower client with only the permissions it needs. See Authentication and permissions.
• Authenticate your users and confirm which Employer they can access before making an API request or creating an embedded session. PayrollKit restricts every resource to the authenticated Partner and every embedded session to one Employer.
• If you use the embedded component, pass only its short-lived session token to the browser.
• Employer users can approve payroll in the embedded PayrollKit workflow. If you build your own approval experience, ask PayrollKit to enable API approval after we have reviewed the flow with you.

Handle payroll data safely

• Do not put access tokens, embedded session tokens, employee details, signed download URLs or full request bodies in logs or analytics.
• Treat Payslip, export and bank payment file URLs as secrets until they expire.
• Verify every signed webhook using the raw request body before accepting it. Follow Keep data in sync for the complete verification and retry process.
• If you build your own approval experience, keep evidence that the person approving payroll was signed in and authorised to act for the employer. PayrollKit records who approved it and the exact calculation they approved.

When you need help

If the question is about signing in, employer access, workforce data or an approval made in your product, your team will usually be best placed to help. If the problem is with the PayrollKit API, a calculation, filing, Payslip or export, contact us.

Email support@payrollkit.io and include as much of the following as you have:

• a brief description of what happened and what you expected;
• the request ID from X-Request-Id or the error response;
• the UTC date and time;
• the affected PayrollKit resource ID;
• the HTTP method, endpoint, status and error or issue code, if applicable; and
• whether an upcoming payroll or filing deadline is at risk.

Do not email employee names, email addresses, National Insurance numbers, bank details, credentials or full payroll request bodies.

Before production

Before production access, PayrollKit and your team will agree support contacts, escalation routes and incident communication. Your Partner agreement will also link to the current information about data location and retention, security evidence, service availability, continuity, data export and change of control.