Your data
What we store, and what we never store.
A certified payroll tool handles your workers’ pay every week. You should know exactly what it keeps. The short version: the federal form does not need a Social Security number or a home address, so we built the app without a place to put one.
What we store
- Your business: name, business address, and the name, title, phone, and email of the person who signs the Statement of Compliance. All of it prints on the form.
- Projects: name, contract number, site location, wage determination number, prime or sub, the classifications and rates you entered, and the prime’s compliance contact if you use Send to prime, with a log of what was sent when.
- Workers: name, the identifying number you assign, journeyworker or apprentice status, program details for apprentices, and the last 4 digits of the SSN only if you choose to use them as the identifier. The last 4 are encrypted at rest with a key the database cannot read.
- Payrolls: hours by day, rates, fringe, deductions as amounts and labels, and the finalized PDF of each payroll, for the retention window.
- Your account: login email and a hashed password, or a magic link. Billing is handled by Lemon Squeezy; we hold a customer ID and subscription status, never a card number.
What we never store
- Full Social Security numbers. There is no field. 29 CFR 5.5(a)(3)(ii)(B) prohibits them on the weekly payroll, and your own records already hold them.
- Workers’ home addresses, phone numbers, emails, or dates of birth. Same reason. They belong in your payroll records, not on the transmittal.
- Bank accounts or card numbers, yours or your workers’.
- Uploaded files. When you import an old WH-347, a spreadsheet, or a wage determination, we read what we need from it, show you a review screen, and discard the file. Full SSNs in an uploaded form are dropped by the schema before anything is saved.
Where it lives
In a Postgres database hosted by Supabase in the United States, encrypted at rest and in transit. Every table has row-level security: a query can only return rows that belong to the account making it, enforced by the database rather than by the application code. Our own staff do not read customer payroll data except to investigate a problem you report, and then only the rows involved.
Who can see it
You, and anyone you invite to your account. Nobody else. We do not sell, share, or use your data to train anything. The prime and the agency see what you send them, which is the PDF you generate.
Taking it with you
Every payroll exports as a PDF and as a CSV with a stable, documented column layout. You can export everything at any time, including on the free plan, including after you cancel. Cancelling stops billing and keeps your account readable for the retention window; you can also ask us to delete it entirely at privacy@certifiedhours.com.
State portals
California’s eCPR, New York’s portal, and a few other state systems require the data the federal form prohibits, including full SSNs and home addresses. CertifiedHours produces the federal WH-347 and does not produce those state filings, so it never needs that data. The app warns you when a project is in one of those states. State requirements.
The legal version of all this is the privacy policy.