Encryption
Bank account numbers, routing codes and statutory identifiers are encrypted at rest with AES-256-GCM. Encryption keys are held in a managed key vault, separate from the database. All traffic is over TLS.
TropicHR
Security
How TropicHR protects payroll data: encryption at rest and in transit, strict separation between companies, role-based access, two-person payroll approval and an immutable audit log.
Data protection
Payroll data, handled carefully.
Payroll holds some of the most sensitive information a business has: salaries, bank accounts and statutory identifiers. TropicalHR is built so that data is protected by default, not by configuration.
Controls
What is in place.
Separation between companies
Every company is an isolated tenant. A database-level filter is applied to every query, so one company can never read another’s data, and background jobs are scoped the same way.
Role-based access
Access is granted by role — Company Admin, HR Manager, Payroll Admin, Payroll Approver, Finance, Auditor — so people see only what their job requires.
Two-person payroll approval
A payroll run cannot be approved by the person who created it, and the payment file stays locked until an approval is recorded.
Immutable audit log
Changes to employees, pay elements, rule sets and payroll runs are written to an append-only audit log — the property, the old and new value, the person and the time. Audit records cannot be edited or deleted.
Data-subject rights and retention
Built-in workflows produce a subject access package or carry out an erasure while retaining the payroll records a business is required to keep. Retention periods are enforced on a schedule.
Architecture
Separate by design.
The API is separate from the browser applications, every request is authenticated, and requests are rate limited per company. The public sign-up path blocks disposable email addresses and holds suspicious registrations for review.