Security
Payroll data deserves more than a password
Smart Punch holds SINs, bank accounts and pay. Here’s what we do to protect them, and what you control.
Protecting the most sensitive details
Encrypted SINs and bank accounts
Social Insurance Numbers and bank account numbers are encrypted with AES-256-GCM before they’re saved. Everywhere else they show only the last few digits.
Owner-only bank changes
Only the owner can change where payroll comes from or where someone is paid, and only after typing their password again. Every view of a SIN and every bank change goes in the audit log.
Each business sees only its own data
Every request is checked against the business it belongs to. Staff see their own pay. Coworkers see each other’s names on the schedule and nothing else.
Sign-in protection
- Passwords are stored with bcrypt, never in plain text. Common and easy-to-guess passwords are refused.
- Five wrong passwords lock an account for 15 minutes.
- Changing or resetting a password signs out every other device.
- Password reset links work once and expire after an hour. Only a scrambled version of the link is stored.
- Resets go through a person who knows the employee, a manager or the owner, so nobody can take over an account by asking a help desk.
Separation of duties
- Managers can’t approve or change their own hours, or another manager’s.
- Managers can’t add pay for themselves.
- Only the owner finalizes payroll.
- Every change to a timesheet needs a reason, and the history shows who made it and when.
How we run Smart Punch
Our support team
Our support staff use a separate console with their own accounts and a code from an authenticator app at every sign-in. They can see who is having trouble signing in, but not your payroll data. Every action they take is recorded with a written reason, and shows in your own audit log too.
Backups
The database is backed up every day, and the last 30 daily backups are kept.
No trackers
No advertising or analytics scripts, on this website or in the app. Fonts and videos are served by Smart Punch itself, so nothing about your visit goes to anyone else.
Secure connections
The live service uses HTTPS only, with strict security headers and cookies that scripts can’t read.
Time clock locations
When the time clock checks a phone’s location, it keeps only the result, such as “45 m from work”. It never stores where someone was.
Where your data is kept
Smart Punch is hosted by our hosting provider in the region we confirm in writing on request. See the Privacy Policy and Data Processing Agreement.
Found a security problem?
Please tell us privately at the form on our Contact page. Include what you found and how to reproduce it. We’ll confirm we received it, keep you updated, and won’t take legal action against good-faith research that follows our Acceptable Use Policy.
Your part
- Give each person their own login. Never share one.
- Only make people managers if they need to be.
- Confirm any bank change in person before you save it. Emails asking to change where someone is paid are a common fraud.
- Turn on clock-in rules so hours are only recorded at work.