Payroll data deserves more than a spreadsheet.
Salaries, phone numbers, locations and attendance are sensitive. This page explains where StaffPrime keeps them, who can see them, and what we do to keep them safe.
Stored in India
The database, servers and files run on Google Cloud in Mumbai (asia-south1).
Encrypted
Data is encrypted on its way between the app and our servers, and at rest on Google Cloud.
Role-based access
Owner, admin, manager and staff roles, with managers limited to the areas they are given.
Checked on the server
Every read and write is checked against the person’s role by our servers, not just hidden in the app.
Short-lived invites
Join codes are single-use, expire after 48 hours, and repeated wrong guesses are blocked.
Your data, your rights
Access, correction and deletion on request, in line with India’s DPDP Act, 2023.
How it works.
Sign-in
Mobile number with a one-time password (verified on our servers, not in the app), Google, or email with a verified address. Staff who joined with a code get their own account.
Who sees what
A person’s role in each business is part of their signed-in identity, and our database rules allow only what that role permits. Creating a business, adding members and granting roles happen on our servers, never directly from a phone.
Invites
Six-digit join codes are valid for 48 hours and work once. After 10 wrong codes in 15 minutes, further attempts are refused. Used and expired codes are deleted automatically.
Location and photos
Location is read when staff check in or out. Photos are compressed to 40 KB or less. Check-in selfies are visible to the business’s managers and the person who took them, and can’t be replaced or deleted from the app, so they stand as a record.
Our support team
A small number of StaffPrime staff can access business data to resolve support requests and keep the service running. That access is granted individually and can be withdrawn at any time.
Payments
Plans are paid through Razorpay or Cashfree on their secure pages. We never see or store card numbers, UPI PINs or bank passwords, and payment confirmations are verified by signature before a plan is activated.
Offline use
The app keeps working without a connection and saves changes on the phone, then sends them when the connection returns.
Deletion
Ask us to delete your account and we remove its personal data within 30 days, except records the law requires us to keep, such as tax invoices. How to delete your account
Who helps us run StaffPrime.
We share data with these providers only to run the service. We don’t sell data or use it for advertising.
| Provider | What for | Where |
|---|---|---|
| Google Cloud and Firebase | Database, servers, file storage, sign-in and notifications | Mumbai, India |
| MSG91 | One-time passwords for mobile number sign-in | India |
| Razorpay or Cashfree | Plan payments | India |
Found a security issue?
Please tell us privately before sharing it with anyone else. Include what you found and how to reproduce it, and we will reply as soon as we can.
Run this month’s payroll on StaffPrime.
Add your business and your first staff member in about five minutes.