Who can see your payroll, who changed it, and where it is kept.
Payroll is the most sensitive data most organisations hold. This page says what Factura does today, in mechanics you can check. Written for the person who has to sign off and be right.
What is protected, and how
Six mechanics that are in the product now. Each one is something you can ask us to demonstrate on your own data during the demo.
- Two-factor sign-in, optional or mandatory per company.
- You choose whether staff may turn it on or must turn it on. When it is mandatory, a user who has not enrolled is taken through enrolment before they can reach anything.
- An audit trail that keeps the value before the change.
- Every change to an employee record, pay structure, approval and policy is written to the audit tables: the table and row, the user, the time, the IP address, and for each column the original value and the new value. It records changes, not the computed payroll figures — the payroll calculation tables are deliberately excluded, so the trail stays a record of what people did rather than what the engine produced.
- One company’s data cannot be read from another.
- Every query filters by company, and the database enforces it a second time: row-level security reads the company from the session, and a connection that has not declared one returns no rows at all. An auditor can trace a figure in your company without seeing anyone else’s.
- A closed pay run does not quietly recalculate.
- Closing a run marks each employee’s calculation closed. To recalculate one person, someone has to reopen that person’s calculation first — a separate, deliberate action, not a side effect of pressing calculate again.
- Approvals are the record, not a formality.
- Leave, loans and expenses move through the approval chain you define, and the request keeps who approved it and when. The approval history is part of the audit trail described above.
- Hosting is your choice.
- Factura runs on your own servers, or we host it for you. If your policy is that employee data stays on infrastructure you control, that is a supported deployment, not an exception we make.
What the AI assistant sees
Factura Intelligence is the one part of the product that sends data outside it. We would rather you read this before the demo than discover it after.
If the answer is no, it stays off. Nothing else in Factura depends on it.
- It runs on an external model provider.
- The assistant is not a model we host. Requests go to a third-party provider over the internet.
- Employee-level data is sent when a feature is used.
- Not aggregates only. Explaining one payslip means sending that employee’s figures — a name, a net pay amount, the components that moved. Explaining a variance sends the driver figures for the periods compared.
- It reads results and writes explanations.
- The engine does the arithmetic. The assistant reads what the engine produced and puts it in plain language. It does not compute pay.
- It never approves, pays or files.
- There is no path by which the assistant approves a request, releases a payment or submits a return. A person does all three.
- Off by default for your company until we switch it on.
- It is enabled per company by Factura, and switched off again on request. Off means off — no requests leave.
- Usage is logged.
- Token usage per request is recorded, so what the assistant was asked to do is countable rather than assumed.
Questions we are asked
Can we run Factura on our own servers?
Yes. Factura runs on infrastructure you control, or we host it for you — your choice, decided before implementation starts. Everything on this page applies either way.
Can an auditor verify a figure without seeing other companies’ data?
Yes. Data is separated by company at the query level and again by the database itself, so an account scoped to one company sees that company and nothing else. The audit trail then shows who changed a record, when, from what value to what value.
Does the audit trail cover the payroll figures themselves?
No, and we would rather say so. It covers changes to employee records, pay structures, approvals and policy — the inputs people control. The payroll calculation tables are excluded, because they are produced by the engine on every run rather than edited by hand. If you need to compare two runs, that is what the payroll comparison and variance reports are for.
Can we turn the AI assistant off?
Yes, and it stays off until you ask for it. It is enabled per company by us and disabled on request. Read the section above first — employee-level data does go to an external model provider when a feature is used, and that is the point to weigh.
Password storage, encryption at rest, backups, where our servers are, and data-protection registration are answered in writing before you sign — ask when you book.
See it on your own numbers.
Thirty minutes with the team behind both products. Bring your pay structure or your chart of accounts, and we walk the workflow you came for.