Last updated 1 November 2026
Security statement
How the hosted Tessera service protects your data. This statement forms part of the Data processing agreement.
Isolation between organisations
Each organisation's data is held in its own schema of the service database. Database connections used to serve an organisation are bound to that schema by PostgreSQL, so a query cannot reach another organisation's tables. Uploaded files are stored under a prefix of the organisation's own, and the sign-in token carries the organisation it was issued for.
Access control
Role-based access with permissions scoped per company; Microsoft Entra ID single sign-on; time-based multi-factor authentication, which administrators can require by role; session revocation; a password policy and lockout; and an audit trail that records who did what, when and from where, including refused attempts.
Encryption
TLS 1.2 or later for every connection; encryption at rest for the database, file storage and backups; passwords stored as bcrypt hashes; integration secrets and API keys stored hashed or encrypted and never shown again after issue.
Operations
Hosted in the United Kingdom. Daily backups retained for 30 days with restores tested quarterly. Dependencies monitored for published vulnerabilities and patched as part of regular releases. Every release is applied to a staging copy before production. Changes to the service are versioned, and each organisation is migrated to each release automatically.
Payroll and statutory accuracy
The payroll engine is tested against HMRC's published test data for the current tax year (PAYE, National Insurance, student loans, directors' NI) and RTI submissions have been accepted by HMRC's test service. HMRC payroll software recognition has been applied for; until it is listed, organisations can also run payroll through a recognised engine they already use and import the results.
Reporting a concern
Security issues: ranjith@hr-payrollsystem.com. We acknowledge reports within one business day and will not take action against anyone who reports a vulnerability in good faith.
Other documents: Subscription terms · Data processing agreement · Privacy notice · Acceptable use policy