How your data is protected
- TLS 1.2 or higher in transit, AES-256 at rest
- Bank details and SSNs held in a separate encrypted store
- SOC 2 Type II audited annually
- Backups encrypted and replicated across three regions
Access controls
Enforce SSO and require MFA for every role that can approve payroll or change banking details. These two settings prevent most of the account takeover attempts we see.
Protecting API keys
Keys are shown once at creation. Store them in a secrets manager, never in source control, and use a separate key per service so revoking one does not take everything down.
- Use sandbox keys everywhere except production
- Rotate on a schedule and immediately after any staff departure
- Scope each key to the narrowest set of companies it needs
Audit logs
Every state change records who did it, when, and from where. Logs are exportable and stream to your SIEM. They are append-only — nobody, including Payflo staff, can edit them.