Security
WagePilot is designed to keep payroll review bounded, attributable, and under human control. This page describes controls present in the MVP and the production responsibilities that remain.
Effective and last updated August 26, 2026Application boundary
All uploads, authentication, analysis, billing, and database operations run in the separate NestJS API. The Next.js application contains the user interface and proxies API requests; it does not hold backend business logic or database credentials.
Authentication and authorization
Sessions use random opaque tokens stored as SHA-256 hashes and sent in HTTP-only, SameSite cookies. Project, review, worker, and finding queries are scoped to the authenticated account. Passwordless codes expire after 10 minutes and lock after repeated invalid attempts.
Payroll handling
Raw files are processed in memory rather than intentionally retained. Saved projects contain structured payroll facts, findings, and decisions only after the user asks to save. PDF extraction uses response storage disabled and deletes the temporary OpenAI file after processing.
Abuse and operational controls
Uploads have type, size, and row-count limits. Public endpoints are throttled, with tighter limits on diagnostics, sign-in, and checkout. Production deployment must add TLS, managed database encryption and backups, secret management, malware scanning, centralized logging, monitoring, and a shared or edge rate-limit store.
Human authority
WagePilot does not automatically change payroll, accept an ambiguous classification, certify a report, or file with an agency or portal. Material compliance decisions stay with the user.
Assurance status
WagePilot does not currently claim SOC 2, ISO 27001, or another formal security certification. Report a suspected security issue to security@wagepilot.ai.