Payroll math is exact and repeatable
Payroll calculations run through tested code and recorded rules. AI does not calculate wages or taxes.
Payroll data stays private. Payroll answers stay reviewable.
Runbook protects sensitive payroll data while making every material calculation, approval, and correction traceable.
Role-based access limits who can see and change payroll. Humans approve important actions. Exact calculations, preserved history, and independent verification make it possible to explain how an approved result was reached.
TRUST MODEL
Protection and proof
AccessRole-based boundaries
MathCode, not AI
ChangesRecorded, not overwritten
ProofIndependently checkable
Privacy
Approval
History
Verification
Trust should show up in everyday payroll work.
The controls matter because they help employers, workers, and advisors prevent mistakes and resolve questions faster.
Before payrollRoles and approvals make it clear who can prepare, review, and authorize a run.
During payrollExact calculations and source records keep each amount connected to the facts and rules behind it.
After payrollPayments, filings, accounting, and supporting evidence remain connected to the approved run.
When something changesThe original record remains visible alongside the correction and the reason for it.
How Runbook keeps payroll explainable
These controls reduce hidden changes, rounding surprises, and records that cannot be reconstructed later.
Money uses exact cents
Amounts stay in whole cents throughout calculation, preventing hidden floating-point rounding errors.
Corrections preserve history
Runbook keeps the original fact, when it applied, when the change was learned, and what the correction affected.
Approved records can be verified
A portable proof record lets an authorized reviewer check structure, calculations, and the platform seal.
Rule sources stay attached
Tax and payroll rule values retain the source and effective period used for the calculation.
Judgment remains reviewable
Automation may prepare or flag work, but the proposal, supporting evidence, human authority, deterministic result, and later outcome remain distinct and connected.
History is tamper-evident
Connected record fingerprints make later alteration detectable without publishing private payroll data.
Security claims should be specific.
Runbook describes the controls it has implemented and clearly labels assurance work that is not yet complete.
Company and role boundaries
Company records are separated, sensitive actions require the right role, and database access closes when authorization is uncertain.
Application request controls
Public service boundaries accept requests only from approved production application origins.
Signing-key custody and recovery
A key-custody and rotation runbook exists. Managed external custody, independent assurance, and a completed loss drill are not claimed today.
Monitoring and recovery
Production-health and backup-and-restore procedures are documented. Operating evidence will grow with the live service.
Personal-data lifecycle and incident response
Retention, deletion, escalation, and incident-response operations are being completed before broad payroll-data intake.
External assurance and insurance
Runbook does not claim SOC 2 certification, a completed penetration test, bound cyber/E&O coverage, or payroll-specific bonding today.
How Runbook protects payroll work
These are the control areas an employer or advisor should expect from a responsible payroll service.
Control areaWhat you should expectHow Runbook approaches it
AccessOnly the right person can view, approve, change, export, or support payroll data.Implemented: role-based permissions and session controls. Documented: a periodic access-review cadence, without operating evidence yet.
Activity historySensitive actions show who did what, when, and why.Recorded approvals, imports, exports, bank changes, tax settings, support access, and administrative actions.
Data protectionPayroll data stays private even when proof is shared.Implemented: encryption, managed secrets and keys, and limited data collection. In development: controlled export and deletion.
Money movementFunds move only with clear authorization, reconciliation, and failure handling.Planned, not live: funding evidence, returned-payment workflows, provider oversight, reconciliation, and escalation procedures. Runbook does not move money today.
ResiliencePayroll relies on monitored systems and rehearsed recovery.Documented: monitoring, alerting, and backup-and-restore procedures. In development: status communication, incident response, and disaster-recovery rehearsal.
Judgment and automationAn action log alone should not substitute for the reason and authority behind a payroll decision.Recorded proposals and evidence, human approval, tested calculation code, explicit authority limits, and connected outcomes.
A portable record for independent review
A Quittance is Runbook’s sealed, independently verifiable payroll proof record. It carries the source facts, applied rules, calculations, approval, correction history, and available external evidence needed to check a payroll without simply trusting Runbook.
Verify payroll proofcheckDocument structurerequired
checkRecomputation from embedded factsrequired
checkPlatform seal and public keyrequired
checkRegistry entry for existencerequired
Tamper-evident without exposing payroll data.
Runbook connects record fingerprints in sequence so later changes are detectable. The payroll details stay private; an authorized reviewer can verify a record without publishing worker or company data.