PayClear is built with security-first architecture. Your payroll data and employee information are protected at every layer.
All POS credentials and sensitive data are encrypted at rest using AES-256-GCM with key versioning. Encryption keys are stored separately from the data they protect.
NeonDB Row-Level Security policies enforce tenant isolation at the database level. One tenant can never access another tenant's data, even if application-layer checks fail.
PayClear is NOT a money transmitter. All ACH payments are processed by Dwolla, who holds the required state Money Transmitter Licenses. We never hold or touch your funds.
Plaid is used exclusively to verify bank account details and generate a one-time processor token for Dwolla. PayClear never stores your bank login credentials.
All authentication is handled by Clerk. We never store passwords. Sessions use short-lived JWTs with org-level access control.
Every payroll run, approval, and admin action is logged with the user ID, timestamp, and IP address. Logs are retained for 7 years.
All sensitive endpoints are rate-limited via Upstash Redis. Integration tests, payroll approvals, and sign-in attempts are all protected against abuse.
Strict CSP headers are enforced on all responses. XSS and clickjacking protections are applied globally via our Next.js proxy.
We take security vulnerabilities seriously. Please report them responsibly.
[email protected]