PayGuard | Data Processing Agreement

1. Definitions

Controller / Customer	The organisation that accesses PayGuard and determines the purposes and means of processing personal data uploaded to the platform.
Processor / PayGuard	PayGuard, which processes personal data on behalf of the Controller to provide the payroll assurance service.
Data Subject	An identified or identifiable natural person whose personal data is contained in payroll data uploaded to the platform — primarily employees of the Controller or its clients.
Personal Data	Any information relating to an identified or identifiable natural person, as defined under applicable data protection law.
Processing	Any operation performed on personal data, including collection, storage, use, disclosure, and deletion.
Subprocessor	A third party engaged by PayGuard to process personal data in connection with providing the service.

2. Processing Roles

The Customer is the data controller (or data business, under applicable privacy law) for personal data uploaded to the PayGuard platform.

PayGuard is the data processor (or service provider) acting under the Customer's instructions.

The Customer determines the purposes and means of processing. PayGuard processes personal data only to provide the payroll assurance service in accordance with the Customer's instructions and these terms.

3. Processing Instructions

PayGuard will process personal data only on documented instructions from the Customer, as set out in the Terms of Service and this DPA. These instructions are:

Process uploaded payroll registers to identify variances between payroll periods or systems
Retain audit results (AuditRun and AuditFinding records) to support audit history and historical review
Transmit structured variance context to the Anthropic API to generate AI-assisted explanations for flagged employees
Present processed outputs to authenticated users of the Customer's account

PayGuard will inform the Customer if it believes any instruction infringes applicable data protection law.

4. Categories of Personal Data Processed

PayGuard processes the following categories of personal data in connection with providing the service:

From uploaded payroll registers (in memory only — not persisted)

Employee identifiers — employee ID, name
Organisational data — department, pay group
Payroll data — gross pay, net pay, deductions, tax, pay components, period dates

From audit results (persisted in database)

Employee identifiers — employee ID, name, department
Payroll values at time of audit — prior net pay, current net pay, variance amounts
Variance classifications, severity ratings, AI-generated explanations
Timestamps and company identifier

Transmitted to Anthropic API (per flagged employee per run)

Employee identifier and name
Pay component values and variance amounts
Variance classification data

PayGuard does not process special categories of personal data (sensitive data) as part of the payroll assurance workflow. If a payroll register uploaded by the Customer happens to contain special category data, the Customer is responsible for ensuring an appropriate lawful basis exists for that processing.

5. Categories of Data Subjects

The personal data processed relates to the following categories of data subjects:

Current and former employees of the Customer or the Customer's clients whose payroll data is contained in uploaded registers
Any other individuals whose payroll data appears in registers uploaded to the platform

6. Purpose of Processing

Personal data is processed solely for the following purposes:

Comparing payroll outputs to identify variances (recurring payroll, implementation validation, parallel-run reconciliation)
Generating AI-assisted explanations of payroll variances to support review
Retaining audit results to support historical payroll audit and trend review
Providing confidence scores and recommendations to assist payroll professionals

PayGuard does not process personal data for any purpose outside the contracted service.

7. Confidentiality

PayGuard will ensure that persons authorised to process personal data are committed to confidentiality or are under an appropriate statutory obligation of confidentiality.

Access to customer payroll data and audit results is limited to personnel and systems required to provide the service.

8. Security Measures

PayGuard implements the following technical and organisational security measures in connection with the processing of personal data:

Encryption in transit: All data transmitted to and from the PayGuard API and application is encrypted using HTTPS/TLS.
Tenant isolation: Each customer's data is logically isolated using company identifier scoping across all database queries and comparison runs.
In-memory file processing: Original uploaded payroll register files are processed in memory (StringIO) and are not written to disk or persisted.
Access controls: Access to the platform requires authenticated credentials.
Infrastructure security: Physical and network security is provided by Render (SOC 2 Type 2, ISO 27001, GDPR-DPA). These certifications apply to Render's infrastructure.

Engineering note: Encryption at rest has not been independently verified at the PayGuard application layer. Render's infrastructure provides storage-level controls. PayGuard will update this DPA as additional controls are implemented and verified.

9. Subprocessors

The Customer authorises PayGuard to engage the following subprocessors to process personal data in connection with providing the service:

Subprocessor	Role	Data processed	Location
Render Services, Inc.	Application hosting & database	All application data including persisted audit results containing employee identifiers and pay values	United States
Anthropic PBC	AI explanation engine (Claude API)	Structured variance context per flagged employee (employee identifier, name, pay values, variance classification)	United States

PayGuard will notify the Customer of intended changes to this subprocessor list (additions or replacements) in advance, providing the Customer with the opportunity to object. Notification will be provided by updating this DPA and, where appropriate, by direct customer communication.

10. Anthropic AI Processing

PayGuard uses the Anthropic API (Claude, model: claude-sonnet-4-6) to generate plain-English explanations of payroll variances for flagged employees.

When generating an explanation, PayGuard transmits structured variance context to the Anthropic API. Raw payroll register files are not transmitted. The data transmitted is limited to what is necessary to generate the explanation for that employee.

Anthropic acts as a subprocessor. Anthropic's data handling commitments, sub-processing terms, and security practices are governed by Anthropic's API terms and data processing agreements, available at trust.anthropic.com.

The Customer acknowledges that: (a) the Anthropic API is a US-based service; (b) variance context data is processed by Anthropic's systems in connection with generating AI explanations; and (c) Anthropic's own data retention and security practices govern how that data is handled by Anthropic.

11. Render Hosting and Database

PayGuard's application and database are hosted on Render Services, Inc. Persisted audit results — including employee identifiers, names, pay values, and variance findings — are stored in a database hosted on Render's infrastructure in the United States.

Render holds SOC 2 Type 2, ISO 27001, and GDPR-DPA certifications for its infrastructure. These certifications apply to Render, not to PayGuard. For Render's security and compliance documentation, see render.com/security.

12. International Transfers

Personal data processed by PayGuard may be transferred to and stored in the United States, as PayGuard's infrastructure (Render) and the Anthropic API are US-based services.

For Customers based in the UK or EEA, transfers to the United States are made in reliance on:

Render's GDPR-DPA and applicable Standard Contractual Clauses for Render-hosted data
Anthropic's applicable data transfer mechanisms for AI processing

Customers with specific international transfer requirements should contact PayGuard at hello@payguardapp.com to discuss how their requirements can be addressed.

13. Data Subject Rights Assistance

PayGuard will assist the Customer in fulfilling data subject rights requests (access, erasure, rectification, restriction, portability) to the extent technically feasible and required under applicable law.

Data subject rights requests in respect of personal data processed by PayGuard should be directed to PayGuard at hello@payguardapp.com.

The Customer acknowledges that, as the data controller, the Customer holds the primary data subject relationship with employees whose data appears in uploaded payroll registers. Direct data subject enquiries (including employee requests) should in the first instance be handled by the Customer.

14. Personal Data Breach Notification

PayGuard will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer personal data processed under this DPA. Notification will be provided by email to the contact on the Customer account.

PayGuard will provide reasonable assistance to the Customer in meeting the Customer's notification obligations to supervisory authorities and data subjects, to the extent required by applicable law.

The Customer remains responsible for notifying supervisory authorities and data subjects in accordance with applicable data protection law, within applicable timescales.

15. Retention and Deletion

PayGuard retains audit results (AuditRun and AuditFinding records, including employee-level data) for as long as the Customer account is active or as required to provide the service.

Original uploaded payroll register files are processed in memory and are not retained after each comparison run.

PayGuard does not currently implement automatic data deletion schedules. The Customer may request deletion of their audit data by contacting hello@payguardapp.com.

Engineering review: Automatic deletion logic is not yet implemented in the current codebase. PayGuard will implement scheduled deletion or customer-controlled deletion tooling as a platform enhancement. This DPA will be updated to reflect the controls in place when those controls are implemented.

16. Return and Deletion of Customer Data on Termination

On termination of the Customer's use of the PayGuard platform, at the Customer's written request, PayGuard will:

Provide the Customer with an export of their audit results in a portable format (CSV or JSON), or
Delete the Customer's audit data from the PayGuard database

To exercise either option on termination, contact hello@payguardapp.com.

PayGuard will comply with a data export or deletion request within a reasonable timeframe.

17. Audit and Cooperation Provisions

PayGuard will make available to the Customer reasonable information necessary to demonstrate compliance with this DPA.

PayGuard will support any audit or inspection conducted by the Customer or a regulator, subject to reasonable notice and to the extent required under applicable law. PayGuard may require that audits are conducted by a mutually agreed qualified third party to protect confidentiality of other customers' data.

PayGuard will cooperate with supervisory authorities as required by applicable data protection law.

18. Changes to This DPA

PayGuard may update this DPA from time to time to reflect changes in the platform, applicable law, or subprocessors. PayGuard will notify Customers of material changes in advance of those changes taking effect.

Updates to engineering controls flagged in this DPA (such as deletion automation) will be reflected in this document when those controls are implemented.

19. Contact and Enquiries

For DPA enquiries, data subject rights requests, or to request a data export or deletion, contact:

hello@payguardapp.com

See also our Privacy Policy and Security & Data page.