How we protect worker data

We hold names, addresses, pay, and the last 4 of SSN for your field crew. Security is a legal obligation and the core of why you should trust us. Plain English, no marketing fog.

What we hold

Each worker's name and address
Last 4 of SSN or the identifier the report requires (encrypted at rest, never logged)
Classification, apprentice level, and fringe plan details
Weekly hours and gross pay for each project
Project details (contract number, DIR project ID, prime contractor)
The original source files you uploaded (unmodified, for audit)

We do not hold your DIR, LCPtracker, or GC portal passwords. Ever.

How we protect it

Encryption at rest on every file and database row (managed infrastructure).
Field-level encryption for SSN fragments on top of that.
Private storage buckets. Downloads use short-lived (15-minute) signed URLs. There is no public link to any file.
Row-level isolation. Automated tests prove client A can never read client B's rows, workers, or files.
Magic-link or passkey login. Optional MFA for client accounts. MFA required for our reviewer account.
AI providers under business terms with zero data retention and no training on your data.
Daily backups with point-in-time recovery. Restores are tested quarterly.
Scrubbed logs. Our error monitoring strips personal data before anything leaves the server.

Retention and deletion

We retain reports and source files for the period California requires contractors to keep certified payroll records (currently three years after project close). You can download your complete history any time from your dashboard. If you cancel service, you keep the data; we retain it only for the regulatory window and then delete it on schedule.

Subprocessors

Our data touches: Fly.io (hosting, in Virginia), Stripe (payments), Resend (transactional email), and an AI provider used strictly for text extraction under business terms with zero retention. We'll publish a full data-processing agreement on request.

Questions

Email hello@certpayroll.com. A real human replies.