Your data
What we store, and what we never store.
A certified payroll tool handles your workers’ pay every week. You should know exactly what it keeps. The short version: the federal form does not need a Social Security number or a home address, so we built the app without a place to put one.
What we store
- Your business: name, business address, and the name, title, phone, and email of the person who signs the Statement of Compliance. All of it prints on the form.
- Projects: name, contract number, site location, wage determination number, prime or sub, the classifications and rates you entered, and the prime’s compliance contact if you use Send to prime, with a log of what was sent when.
- Workers: name, the identifying number you assign, journeyworker or apprentice status, program details for apprentices, and the last 4 digits of the SSN only if you choose to use them as the identifier. The last 4 are encrypted at rest with a key the database cannot read.
- Payrolls: hours by day, rates, fringe, deductions as amounts and labels, and the finalized figures, from which the PDF is regenerated on demand, for as long as your account is open.
- Your account: login email and a hashed password. Billing is handled by Lemon Squeezy; we hold a customer ID and subscription status, never a card number.
What we never store
- Full Social Security numbers. There is no field. 29 CFR 5.5(a)(3)(ii)(B) prohibits them on the weekly payroll, and your own records already hold them.
- Workers’ home addresses, phone numbers or emails. The same rule keeps them off the weekly transmittal; they belong in your own payroll records.
- Dates of birth. The form never asks for one, so neither do we.
- Bank accounts or card numbers, yours or your workers’.
- Uploaded files. When you import an old WH-347, a spreadsheet, or a wage determination, we read what we need from it, show you a review screen, and discard the file. Full SSNs in an uploaded form are dropped by the schema before anything is saved.
Where it lives
In a Postgres database hosted by Supabase in the United States, encrypted at rest and in transit. Every table has row-level security: a query can only return rows that belong to the account making it, enforced by the database rather than by the application code. Our own staff do not read customer payroll data except to investigate a problem you report, and then only the rows involved.
Who can see it
You. We do not sell your data or use it to train anything. The prime and the agency see what you send them, which is the PDF you generate. Three of the companies that process data for us touch payroll data, each for one purpose: Resend delivers the emails you send (a payroll PDF to a prime, a reminder to you); Anthropic reads a document only when you upload one (a wage determination, a filed WH-347, a payroll spreadsheet, or a timesheet photo, which carry worker names and hours), does not train on it, and deletes it within 30 days under its standard terms; Lemon Squeezy handles the card. The privacy policy lists every processor, including hosting, sign-in and analytics.
Taking it with you
Every payroll exports as a PDF and as a CSV with a stable, documented column layout. You can export everything at any time, including on the free plan, including after you cancel. Cancelling stops billing and keeps your account readable while it is open. The regulation makes you, not us, responsible for keeping every certified payroll and its records for three years after all work on the prime contract is completed, so download the PDFs and CSVs to your own files as you go and before you delete anything. Deleting is yours to do: Settings, Delete this account removes the workers, the projects, the payrolls, and the login, and you can still ask us at privacy@certifiedhours.com instead.
State portals
California’s eCPR, New York’s portal, and a few other state systems require the data the federal form prohibits, including full SSNs and home addresses. CertifiedHours produces the federal WH-347 and does not produce those state filings, so it never needs that data. The app warns you when a project is in one of those states. State requirements.
The legal version of all this is the privacy policy.