Payroll data is some of the most sensitive data a small business holds: Social Security numbers, bank details, wages. We treat it that way from the database up, not just in the interface.
Social Security numbers and bank account details are encrypted with Fernet (AES 128 CBC with HMAC SHA256 authentication), so a tampered value is rejected rather than silently decrypted. No one, including our own staff, sees a full number in the app unless they specifically need to.
Every client and employee route reverifies record ownership on the server. A client can’t view another company’s data by guessing a URL, and that scoping is enforced at the database level, not only in the application code.
Authentication uses HttpOnly, secure cookies with passwords hashed with bcrypt. Nothing sensitive is ever stored in browser local storage.
Employers, employees, contractors and Ideal Workforce staff each operate under a distinct, scoped role. Every record change is tied to a verified role, not just a login.
Repeated failed login attempts are throttled to slow down credential guessing attacks against any account.
Run by an IRS registered electronic filing provider (EFIN active) with withholding logic built directly from IRS Publication 15T, and single use, expiring links for self service onboarding rather than reusable shared URLs.
Employers, employees and 1099 contractors log into the same platform but see entirely different data. That separation isn’t a matter of hiding a menu item; it’s enforced where the data lives, so a bug in one screen can’t leak another company’s records.
We don’t publish compliance certifications, audit badges, or third party security ratings we haven’t actually earned. If that changes, this page will say so specifically, with the certifying body named.
If you believe you’ve found a security issue, contact support@idealworkforce.us directly rather than filing it as a general support request.
We’re glad to walk through it before you sign up.