How SmartCompaire protects the payroll data you load into it

Tenant isolation for payroll data

Signed-in API requests are kept apart by the database; sign-in and background jobs bypass row-level security and scope each query to the organization in code.

Roles and permissions

• Four roles. Viewer, member, admin and owner, each a preset drawn from 28 permissions. Viewers read; members also import, run comparisons and manage defects; admins also delete pay data, manage thresholds and invite people; owners also manage permissions.
• Per-person adjustments. Owners can grant or remove permissions per person; a removal beats a grant, and changes are audited. For now this covers only some actions: mapping, pay-data and result-row edits, and jobs queued through the general job endpoint, check role only.
• No escalation. Nobody can give a role higher than their own, and the last owner cannot be demoted or removed.
• Checked on the server. Checks run in the API; screens hide what you cannot do but are not the control.

Sign-in and sessions

• Passwords. At least 12 characters, stored as bcrypt hashes. Eight failed attempts lock the account for 15 minutes. Login gives one message for an unknown email or a wrong password.
• Google sign-in. Uses PKCE and only the openid, email and profile scopes. Existing accounts link only to Google-verified emails. An organization can require Google sign-in, and verified Workspace users from a domain it lists join automatically with the default role.
• Short sessions. By default, access tokens last 30 minutes and must match a live server session; refresh tokens last 14 days and rotate on every use. Reusing an old one revokes all that user’s sessions.
• Sign-out that sticks. Sign-out revokes the server session, and users can sign out everywhere. Password changes and removals also end sessions.
• No cookies. Tokens live in the tab’s sessionStorage, cleared on sign-out or tab close. Invitation tokens are stored as hashes and expire after 72 hours by default.

Encryption of payroll data in transit and at rest

Security headers and browser protections

• Content Security Policy. The web app runs only its own scripts, with no unsafe-inline or unsafe-eval, and connects only to the SmartCompaire API and, for the avatar, HeyGen and LiveKit. Remote images and framing are blocked.
• Other headers. X-Frame-Options DENY, nosniff, a strict referrer policy and a Permissions-Policy that disables camera, location and payment. API responses are no-store, so payroll data is not cached, and errors return only a generic message and request ID.
• Uploads. Spreadsheet and CSV only, up to 100 MB by default, checked by extension and size, not virus scanned. Error reports neutralize cells that could run as formulas.

An append-only audit log

• Cannot be edited. Triggers block normal updates and deletes of audit and AI action rows, though database administrators can bypass them. Entries outlive deleted users and projects.
• What an entry holds. Organization, user, any impersonator, action, resource, changed fields, outcome, IP address, browser, request ID and time.
• What is recorded. Logins and failures, organization switches, password changes, invitations, member, role and permission changes, organization and email settings, and project create, update, archive, restore and delete.
• What is not. Imports appear only in job records; result-row edits keep only a last-updated time. Dataset clears, threshold, status-rule, mapping, defect and KD/AD changes, and archives queued as jobs, are not logged.
• Who reads it. Only platform administrators read the general audit log. Admins and owners can fetch their organization’s AI action trail via the API; no screen exists yet.

Where AI requests go

How a question to Hirra, the beta in-app assistant, travels.

1. Browser to SmartCompaire

   Chat requests go only to the SmartCompaire backend, and no AI keys are in the browser. With the avatar on, reply text also goes to HeyGen.

2. Backend to the AI service

   The backend calls the Corra AI service with a shared internal secret, passing your user ID, organization, role, email, IP address, user agent, sign-in token, and any administrator or impersonation flag.

   Learn more

3. Reads with your permissions

   Corra has no database access. It calls the SmartCompaire API with your own token, so the same checks apply, and refuses any call naming another organization.

4. To OpenRouter and model providers

   Prompts and the data Hirra reads, including employee numbers and amounts, go unredacted to OpenRouter, a third-party model router. Its automatic router picks a provider per request (fallbacks: Anthropic, OpenAI and Google models), and with no allowlist set any provider there may receive it. No zero-retention or no-training option is set.

5. Recorded and limited

   Tool calls are logged, secrets removed and personal fields masked. Without confirmation, Hirra can create projects, raise and update defects and KD/AD records, edit result-row workflow fields, generate reports and cancel jobs; no setting turns this off. Runs, imports, bulk updates, threshold changes and archiving need a confirmation chat cannot give yet.

Outside services that receive data

No analytics or tracking scripts are loaded.

Retention and deletion

• Default timers. By default, report downloads stop after 14 days, download links after 15 minutes and invitations after 72 hours; expired sessions are removed after 30 days.
• Deleting a project. Only archived projects can be deleted, by typing the exact name. Mappings, pay data, runs, results, defects, KD/AD records, reports and jobs leave the database; an audit entry stays.
• What stays. Uploads, reports, error reports and exports stay in storage, even after project deletion; the application never removes them. Pay data and chat history never expire automatically. There is no self-service account or organization deletion, and no data-export or erasure request tool.

Limits we state plainly

• Operator access. Platform administrators, the operator’s staff, hold every permission and can read every organization’s data, in the admin portal or by switching into one. Switching is audited; reading data is not.
• No certifications. SmartCompaire claims no SOC 2, ISO 27001, HIPAA, PCI or other certification or attestation.
• Sign-in options. No multi-factor authentication, no single sign-on other than Google, and no self-service password reset.
• Not covered here. Penetration testing, firewalls, backups, disaster recovery and uptime commitments.

Frequently asked questions