Effective August 28, 2026
Security
WageComply is designed around tenant isolation, fail-closed compliance workflows and evidence preservation. This page describes the controls implemented for federal V1 without disclosing secrets or internal attack details.
Tenant isolation
Organization access is based on explicit membership records. PostgreSQL row-level security is enabled and forced on customer-facing tenant tables, and cross-tenant relationships use company-scoped constraints where practical.
Private files and reports
Payroll reports, wage-source documents, imports, submission proof and project evidence use private storage. Customer downloads are authorized against tenant records and use short-lived signed access rather than public object URLs.
Certification integrity
Certification is blocked while required facts or blocking findings remain unresolved. Certified report versions and certification events are preserved as immutable evidence; corrections create linked amendments instead of replacing prior certified facts.
Secrets and provider boundaries
Server credentials for Supabase, Paddle, Resend and Gemini are kept out of browser-exposed environment variables. Paddle webhooks require cryptographic signature verification and idempotent event processing. Operational error storage is restricted to safe diagnostic codes instead of provider payloads.
Software assurance
The release process includes locked dependency installation, deterministic tests, TypeScript validation, production dependency auditing, static secret/PII checks, migration checks, database linting, tenant-isolation testing and pre-production adversarial workflows.
Incident handling
Suspected cross-tenant access, credential exposure or payroll-data disclosure is treated as a security incident requiring access containment, secret rotation where appropriate, evidence preservation, impact analysis and qualified legal/privacy guidance.
Reporting a concern
Signed-in customers should report security-sensitive issues through Settings → Support so the request is tied to the correct organization. A dedicated public security contact will be published before normal-customer launch.