On this page
What this does
A company file holds all of a company's payroll data in one file. The whole file is encrypted with the company password. Without the password or the recovery key, the file cannot be read.
What is protected
- Every table in the file: employees, pay runs, settings, documents, the audit log and the users.
- Backups. A backup is an exact copy, so it is encrypted the same way. It opens with the password that was current when it was made.
- Exported company files. A file you export or email stays encrypted. The password is not in it.
- Documents you attach to an employee, which are stored inside the file.
How
The file is encrypted as a whole with ChaCha20-Poly1305, through SQLite3 Multiple Ciphers. Nothing is stored beside the file.
SIN and bank numbers
SINs and bank account numbers have a second layer. Each is encrypted by itself with keys kept inside the file. This is why they show masked on screen.
Where other secrets are kept
- Your licence and sign-in token. In the computer's secure storage (Windows Credential Manager, Keychain, or the platform's equivalent). In the browser edition they are kept encrypted in the browser's storage.
- The email password for sending stubs. Inside the company file, encrypted.
- A remembered company password, if you ticked Remember on this device. In the secure storage of this computer.
Good to know
- The password can be changed at any time. The file is re-encrypted and you get a new recovery key.
- The recovery key is the only other way in. Keep it apart from the password.
- The licence service does not hold your company files.
- Clearing browser data deletes company files kept in the browser edition. See Browser edition: storage and Download company file.