How we protect your payroll data

Our role

For your employees’ payroll data you remain the controller and we act as your processor. We process it only on your instructions, to deliver the service in your engagement letter. We do not use it for our own purposes and we do not share it outside the sub-processors we tell you about.

For the contact details of the people we deal with at your organisation, and our own client and billing records, we act as a controller in our own right. That is covered by our privacy notice.

Where your data is held

• Payroll platform. Payroll is processed in Paycircle, supplied by The Access Group and hosted on Microsoft Azure, with customer databases stored in the United Kingdom. Paycircle holds ISO 27001 and Cyber Essentials certification.
• Our own systems. Correspondence and client records are held in Microsoft 365. Client communication and support tickets are handled in HubSpot.
• Payments. Where you take our payment service, payments are made through Telleroo, which stores data in Germany, a country covered by UK adequacy regulations, or through CreDec in the United Kingdom.
• Our team. A small, fully remote, directly employed UK team. Access to your payroll is limited to your payroll specialist, their manager and the director. We do not subcontract payroll processing and we do not use offshore teams.

Independent certification

• Cyber Essentials. Certified across our whole organisation, including the cloud services we use to run the business.
• ICO registration. Registered with the Information Commissioner’s Office under reference ZA240756.
• HMRC supervision. Supervised by HMRC for anti-money laundering purposes.
• Professional indemnity. £1,000,000 of cover.
• Platform certification. ISO 27001 is held by Paycircle and The Access Group for the payroll platform. We set that out plainly so your assessment rests on who actually holds which certificate.

The controls we apply

• Multi-factor authentication on every cloud service where it is available, for all users.
• Unique accounts, least privilege access, and a defined process as people join and leave.
• Security updates applied promptly, anti-malware across all devices, and company-managed laptops with secure configuration.
• Encryption in transit across every platform we use, and encryption at rest on the payroll platform.
• Reference checks before a start date, confidentiality obligations in every contract, and recorded training in data protection, cyber security and anti-money laundering.

Payment controls

• Every payment run is prepared by one person and approved and released by a second, with no value threshold.
• Employees change their own bank details only through the secure portal. We do not act on bank detail changes sent by email.
• Payments are subject to Confirmation of Payee, so account name mismatches are caught before funds move.
• Funds are released only after you have approved the payroll.

Sub-processors and transfers

We use a short, named list of sub-processors: The Access Group for the payroll platform, Microsoft for email and documents, HubSpot for client communication, and Telleroo or CreDec for payments. We give you at least 30 days’ written notice before we add or replace any of them. Your pension provider, HMRC and The Pensions Regulator are not sub-processors: they act as controllers in their own right for the data we send them on your instructions.

Payroll processing and document storage take place in the United Kingdom. Where any processing happens outside the UK, it is either in a country covered by UK adequacy regulations or under the UK international data transfer addendum to the standard contractual clauses.

Artificial intelligence

No pay decision is made by a machine. Every payroll is prepared, reviewed and approved by a named member of our team.

Request the full pack

Our full Data Protection and Security Overview covers our certifications in detail, our technical and organisational measures, our sub-processor register and our contractual commitments, and is issued with the Paycircle security pack. If you are completing a supplier assessment, request a copy and we will send it the same working day.