Separation of duties
The person who calculates a run cannot be the one who approves it. Approval by the calculator is refused, so money always passes two people.
Security
Every change is on the record.
Who opened the month, which rates were used, who approved it, and what came out, kept for as long as each country requires and impossible to edit after the fact.
History · pay run GH-2026-08
- 09:04:12 Run opened by A. Boateng · period 2026-08
- 09:04:31 Rates locked in · GH.PAYE.v4, GH.SSNIT.v2
- 09:06:02 Calculated · 1 employee, no problems
- 09:11:48 Approved by K. Owusu · a second person
- 09:12:07 Files created · run locked
Nothing here can be edited or deleted. Exportable, and kept for as long as each country requires.
Every change on the record
Who opened a run, which rates it used, who approved it, and what came out. Kept for as long as the country requires, and impossible to edit after the fact.
Rates that cannot change under you
A month that has been paid keeps the rates in force then, for good. New rates are new versions, each countersigned by a second named person before they go live.
Access by role
Each person signs in with their own account and holds only the permissions their role grants. Reading and approving are separate rights, granted separately.
Every connection is encrypted. Passwords and integration secrets are stored encrypted, never in the clear.