General information
Q.What is the name of the service and the organisation behind it?
A. The service is MySalaryPal ("MSP"), operated by Gary Curran as a sole trader based in Ireland. Legal contact: hello@mysalarypal.com.
Q.What is the service used for?
A. MySalaryPal is a multi-country payroll communication platform for employees and employers. It stores payslips, extracts payroll figures, delivers AI-powered explanations, and provides audit, notification and privacy self-serve tools.
Q.Who is the data controller and who is the processor?
A. For direct employee accounts, MySalaryPal acts as data controller. For employer workspaces, the employer is the controller of employee payslip content and MySalaryPal acts as processor under a GDPR Article 28 Data Processing Agreement at /dpa.
Q.How can we contact your security team?
A. All security, privacy and compliance enquiries go to hello@mysalarypal.com. We acknowledge security reports within one business day.
Hosting & data residency
Q.Where is data stored and processed?
A. Primary database, authentication, file storage and backups are hosted in the EU region (Frankfurt, DE) via Supabase. Edge traffic is routed through Cloudflare's EU edge network. No core payroll data is intentionally transferred to the US for processing.
Q.Do you offer data residency options?
A. The standard service is EU-only. Enterprise customers may request dedicated workspace configuration and additional contractual commitments; contact hello@mysalarypal.com.
Q.How is tenant data isolated?
A. Each workspace is a separate tenant. Row-Level Security (RLS) policies at the database layer ensure queries only return data the authenticated user is authorised to access. Application code never bypasses RLS for routine operations.
Encryption
Q.What encryption is used in transit?
A. TLS 1.2 or higher for all browser and API traffic. HTTPS is enforced across all public routes.
Q.What encryption is used at rest?
A. AES-256 encryption at rest for the database and object storage. Backup volumes are also encrypted.
Q.Do you encrypt data in use or perform application-level encryption?
A. Application-level encryption is not currently used for routine payroll data. Access is enforced through database RLS, authentication, and role separation rather than per-field encryption.
Access control & authentication
Q.What authentication methods are supported?
A. Email/password with bcrypt-hashed passwords, Google OAuth, and SAML 2.0 workspace-level single sign-on (Enterprise, on request). Passkeys (WebAuthn) are available as a phishing-resistant second factor for admins and employees.
Q.How are user roles managed?
A. Roles are stored in a dedicated user_roles table. A SECURITY DEFINER has_role() function checks role membership. RLS policies use this function to enforce role-based access at the database layer. Roles include employee, HR, payroll, admin and owner.
Q.Is multi-factor authentication enforced?
A. Passkeys are available for all accounts. Workspace-level MFA enforcement is on the 2026 roadmap. Admin sign-in is currently protected by password plus optional passkey and session controls.
Q.How are sessions managed?
A. Sessions are handled by Supabase Auth with HTTP-only cookies. Admins can revoke user access from the workspace directory. Inactive sessions expire automatically.
Audit logging & monitoring
Q.What activity is logged?
A. Every payslip view, upload, download, admin action, change request, privacy request and authentication event is logged with user ID, timestamp, IP address, action type and relevant metadata.
Q.Are audit logs tamper-evident?
A. Yes. Audit log rows are SHA-256 hash-chained so that deletions or back-dating can be detected by re-walking the chain. Workspace admins can export logs in CSV or JSON format for compliance reviews.
Q.What monitoring is in place?
A. Rate limiting, anomaly detection and automated alerting are configured on authentication and sensitive endpoints. Cloudflare WAF and DDoS protection sit in front of the application.
Incident response
Q.What is your incident response process?
A. Security incidents are triaged, contained, investigated and remediated by the operator. Affected workspace admins are notified without undue delay and, where personal data is involved, within 72 hours of becoming aware of the breach.
Q.How do customers report incidents or vulnerabilities?
A. Reports can be sent to hello@mysalarypal.com. We also publish a security.txt at /.well-known/security.txt with a 2-day response commitment.
Q.Do you have a public status page?
A. Yes — status and planned maintenance are published at /status.
Data retention & deletion
Q.How long do you keep payroll data?
A. Payslip and payroll records are retained for 7 years after the end of the tax year they relate to, to satisfy statutory payroll record-keeping rules across Ireland, the UK, Germany and other EU jurisdictions. Tamper-evident audit logs are retained for 7 years. Account data is kept while the account is active. Authentication and security logs are kept for 12 months. Encrypted backups are retained for 30 days.
Q.Can we export or delete our data?
A. Yes. Workspace admins can export workspace data in CSV and JSON formats at any time. On subscription termination, data can be exported for 30 days, then deleted or anonymised within a further 30 days, except where retention is required by law.
Q.How do employees exercise GDPR rights?
A. Employees can use the in-app privacy request tools at /privacy/requests to access, rectify, erase or port their data. We respond within 30 days. Statutory payroll and audit records are retained as required by law even after erasure requests.
Sub-processors & international transfers
Q.Who are your sub-processors?
A. Supabase (database, auth, storage — EU), Cloudflare (edge, WAF, CAPTCHA — global with EU PoPs), Resend (transactional email — EU/US), Paddle (payments, Merchant of Record — UK/EU), Google Gemini and OpenAI (opt-in AI explanations — EU/US). A full list is published at /trust#subprocessors.
Q.How do you manage international transfers?
A. Primary processing is in the EU. Where data is transferred to sub-processors outside the EEA or UK, we rely on the European Commission's 2021 Standard Contractual Clauses and, where applicable, the UK International Data Transfer Addendum.
Q.How are sub-processor changes communicated?
A. Material changes are notified at least 30 days in advance by posting an update to this page and emailing workspace admins. Customers may object on reasonable data-protection grounds.
Compliance & certifications
Q.Which regulations does MySalaryPal align with?
A. MySalaryPal is designed to support compliance with GDPR (EU 2016/679), UK GDPR, the Irish Data Protection Act 2018, ePrivacy regulations, and the EU Pay Transparency Directive (2023/970). Payment card data is handled by Paddle, our PCI-DSS Level 1 Merchant of Record.
Q.Do you have ISO 27001 or SOC 2 certification?
A. Not yet. ISO 27001, SOC 2 Type II and Cyber Essentials Plus are on the 2026 roadmap and will be funded from post-pilot revenue. We are happy to share our control mapping and policies under a mutual NDA.
Q.Will you sign a Data Processing Agreement?
A. Yes. Our DPA is available at /dpa and forms part of the Terms of Service. We can also provide a counter-signed PDF copy on request.
Q.Do you provide a DPIA template?
A. Yes. A pre-filled DPIA template is available at /legal/MySalaryPal-DPIA-Template.pdf for a customer's DPO to complete with organisation-specific details.
Vulnerability management
Q.How do you manage security patches?
A. Dependencies are reviewed regularly. Security patches are applied on a risk-based schedule, with critical vulnerabilities patched as soon as a fixed version is available and validated.
Q.Do you run penetration tests?
A. A third-party penetration test is planned before the first production pilot. We will publish a summary of the scope and remediation status on request under NDA.
Q.Do you have a bug bounty program?
A. Not yet. Responsible disclosure is welcomed via hello@mysalarypal.com. We do not offer paid bounties during the pilot phase.
Business continuity
Q.What is your backup and recovery strategy?
A. Supabase provides daily encrypted backups with 7-day point-in-time recovery (PITR). Backups are retained for 30 days and stored in the same EU region as the primary database.
Q.What is your recovery time objective?
A. The platform is designed to recover from a database failure within 4 hours via point-in-time restore. Recovery is validated through the provider's backup procedures.
Q.What happens if the service is discontinued?
A. Customers receive at least 90 days' notice of service discontinuation. During that period, full data export is available and, on request, we will provide a copy of workspace data in a structured format.
Next steps & contact
Q.How do we start a security review or pilot?
A. Book a demo at /demo or email hello@mysalarypal.com. We can answer your questionnaire, provide the DPA, share a DPIA template, and arrange a security walkthrough with your IT or DPO team.
Need a tailored response?
We can answer your specific questionnaire (CAIQ, SIG Lite, vendor-specific) within 5 business days. Email the spreadsheet or PDF to hello@mysalarypal.com or book a security walkthrough.