Start

Trust and security

What PayCaptain does to protect payroll data, and what your integration must do.

Shared responsibility#

Payroll data is personal and financial. An integration is only as trustworthy as its weakest side, so the responsibilities are split plainly.

PayCaptain	Your integration
HMRC-recognised payroll software	Sends only PAYE employees, with complete and valid data
ISO 27001 and Cyber Essentials Plus certified	Keeps the API key secret and server-side
Core software operated by PayCaptain UK personnel	Controls who can view data and trigger API calls
HTTPS on every endpoint	Enforces TLS 1.2 or higher and encrypts stored data
Publishes every rule on this site	Validates against those rules before sending

API keys#

Your API key authenticates your application to PayCaptain. Treat it as a privileged credential.

Must The API key is a secret. It must never be visible to end users.

Store the key in a secrets manager or environment variable. Never hard-code it.
Call the API from your server only. Never from a browser or a mobile app.
Keep the key out of client-side code, app bundles and every log.
No end user of your application may view, retrieve or export it.
If you suspect a compromise, rotate the key and tell developer@paycaptain.com immediately.
Keep an audit log of every API call: timestamp, endpoint, and the user or process that triggered it.

Data protection#

Your application handles employee personal data as a data processor under UK GDPR. These are legal obligations, not recommendations.

Principle	What you must do	Reference
Data minimisation	Collect and send only the fields your integration needs.	UK GDPR Art. 5(1)(c)
Purpose limitation	Use the data for payroll processing only.	UK GDPR Art. 5(1)(b)
Encryption in transit	Enforce TLS 1.2 or higher on all API traffic.	ISO 27001 A.10
Encryption at rest	Encrypt stored employee data with AES-256 or equivalent.	ISO 27001 A.10
Access control	Use role-based access. Only authorised people and processes see data or trigger calls.	ISO 27001 A.9
Retention	Keep employee data no longer than necessary.	UK GDPR Art. 5(1)(e)
Breach notification	Tell PayCaptain within 24 hours of any breach affecting data sent to or received from the API.	UK GDPR Art. 33
Right to erasure	Be able to delete an individual's personal data on request.	UK GDPR Art. 17

Compliance#

API calls that do not meet the rules on this site are rejected. Repeated non-compliance may lead to API access being revoked. The compliance tests let you prove your integration meets every rule before it goes live.

This site#

This site sets no cookies, runs no analytics and loads nothing from third parties. Fonts, styles and scripts are served from the same origin under a strict Content Security Policy.