Security & compliance

A trust centre, not a marketing page

Because PayStaff sits between a business and its cross-border payment and workforce data, this page is meant to answer procurement and security questions directly — including which parts of the regulatory picture sit with PayStaff and which sit with our banking and payment partners.

Overview

What this page covers

🔒

Access controls

Role-based access to workforce, payment and monitoring data across your organisation, so a team lead sees their team and finance sees payments.

🔐

Data protection

Client, worker and payment data is encrypted in transit using TLS 1.2 or higher and encrypted at rest within our hosting environment.

👁

Monitoring-data protection

SIPAG’s time, activity and screenshot data is stored separately from core account and payment records, with its own access controls.

📋

Auditability

A chronological record of approvals, invoices, adjustments and payments is kept for each client relationship.

🌐

Hosting

PayStaff is hosted on infrastructure operated by established cloud providers, with production data held in Australian data centre regions.

⚠

Incident response

Security incidents are triaged by our internal team, with affected clients and professionals notified in line with our Terms of Service and applicable law.

👤

Privacy

How personal data is collected, used and retained for both clients and workers is set out in full in our Privacy Policy.

🔗

Subprocessors

Cross-border funds movement is executed by regulated banking and payment partners; PayStaff does not itself hold or transmit client money outside those rails.

Certifications

What we won't claim without evidence

We won’t list SOC 2, ISO 27001 or any other certification here unless PayStaff has actually achieved it and can point to the evidence. PayStaff’s security programme is modelled on recognised frameworks as the company scales, and formal certification is on the roadmap as transaction volume and enterprise demand justify the audit investment. The same discipline applies to encryption standards, data residency and uptime — each is documented specifically here rather than asserted generally.

Regulatory position

Where PayStaff sits, and where our partners sit

PayStaff is a software and workflow platform. It is not a bank and does not hold an Australian Financial Services Licence in its own right. Cross-border payment execution, currency conversion and fund custody are performed by PayStaff’s licensed banking and payment partners under their own regulatory approvals in Australia and the Philippines.

Function

Who is responsible

Holding client funds prior to payout

Currency conversion (AUD → PHP)

Identity and business verification (KYC/KYB)

Anti-money-laundering and sanctions screening

Contractor vs. employment classification

Platform access control, audit trail and monitoring-data handling

PayStaff’s licensed payment partner

PayStaff’s licensed payment partner, disclosed via PayStaff’s interface

Shared: PayStaff collects the information; verification is performed by our compliance partner

PayStaff’s compliance and payment partners, integrated into the funding and payout flow

The Australian client, informed by their own legal and tax advice — PayStaff does not make this determination

PayStaff directly

Procurement questions

For security and compliance teams evaluating PayStaff

If your organisation needs a completed security questionnaire, a data processing agreement, or detail on a particular control before proceeding, we’d rather work through that directly with your team than approximate it here. Reach out through Get Started and select “Something else” to route your enquiry to our security and compliance contact.

Evaluating PayStaff for procurement?

We'll work through your security questionnaire or specific requirements directly.