Security and data handling

Certified payroll carries every worker's name, pay and deductions. This page explains exactly what PrevailReady does with that data, what it stores, and how you can check it yourself.

Your payroll file stays in your browser

The app reads your payroll export and timesheet inside your web browser, runs the checks there, and builds the WH-347 PDF and the New York XML there. The contents of your files (worker names, identifiers, addresses, hours, rates, deductions and net pay) are not sent to our servers.

The app's Content Security Policy only allows the browser to connect to prevailready.com, to Paddle for checkout, and to Cloudflare Web Analytics, so a page cannot send your file anywhere else.

Check it yourself

  1. Open the app, then open your browser's developer tools (F12, or right-click and choose Inspect) and select the Network tab.
  2. Upload your payroll file, run the checks, and download the WH-347.
  3. Look at the requests sent to prevailready.com. You will see your project settings and matching choices being saved, and a report record with the project, week ending, payroll number and number of workers. No request carries worker names, identifiers, hours, rates or pay.

What is stored, and where

Our servers store only what the app needs to work again next week:

  • Your sign-in email address and session records.
  • Project settings you enter: contract details, wage determination rates, fringe plans, apprenticeship programs and the certifying official.
  • Your files' column names, and the job names and cost codes you matched to this project's classifications (for example "Riverside Pump Station" or "Electrical"), so next week's files match. No worker names, identifiers, hours or pay.
  • A record of each payroll week you created and how many workers it had, for billing.

This data is stored with Cloudflare (Cloudflare Pages and its D1 database, with the primary copy in Cloudflare's Eastern North America region). The full list, including analytics and email delivery, is in the privacy policy.

Connections

The site and the app are served only over HTTPS, and browsers are told to always use HTTPS for prevailready.com and its subdomains (HTTP Strict Transport Security for one year). Pages cannot be embedded in other sites.

Signing in

  • There are no passwords to steal or reuse. You sign in with a link sent to your email address.
  • Each sign-in link works once and expires after 15 minutes.
  • Sign-in links and session identifiers are stored only as SHA-256 hashes, never in readable form.
  • The session cookie is HttpOnly (page scripts cannot read it), Secure (sent only over HTTPS) and SameSite, and lasts 30 days unless you sign out.
  • Sign-in requests are rate-limited per network address and per email address.

Payments

Payments are processed by Paddle.com, our merchant of record. Card and bank details are entered in Paddle's checkout and never reach our servers; we receive the order details we need to add your plan or report credits.

Deleting your data

You can delete your account in the app (Account then Delete account). It deletes your projects, settings and report history. Retention and your rights are described in the privacy policy.

Reporting a security issue

If you believe you have found a security problem, email [email protected] with the details.