Cloud based payroll software: what improved, and what got sharper

Verifying the things that matter

1. Establish who can see pay data. Inside your organisation and inside the vendor. Ask specifically whether support staff can view records, whether that is logged, and whether you can see the log.
2. Require multi factor authentication for anyone who can pay. An account that can change bank details is an account worth attacking. This is the single highest value control on a cloud payroll and it is often left optional.
3. Test the deadline case, not the happy path. Ask what happens if the service is unavailable on your pay day. A credible answer names a fallback and a support escalation; a vague one is telling you there is no plan.

What moving to hosted payroll software actually improved

Statutory updates arriving without a project, access for a distributed finance team, and a record that survives the loss of an office. For payroll, the first of those is the largest, because keeping rates and thresholds current was a recurring source of error in installed software.

Disaster recovery also improved by default. A payroll that can be run from anywhere is a payroll that survives a building being inaccessible, which several employers discovered they needed the hard way.

What got sharper rather than better

Credential risk. Payroll fraud increasingly takes the form of somebody changing bank details rather than breaking anything, and a cloud login reachable from anywhere makes that attempt cheap. Controls on changing payment details, ideally with a second person confirming, matter more than any technical security feature.

Concentration risk is the other one. When many employers share a provider, an outage or an incident affects all of them at once, which is a different shape of risk from a server in your own building failing.

Cloud based HR and payroll in one record: the permissions problem

The advantages are real and so is the permissions problem. Health information, disciplinary records and salary now sit in one system with one access model, and the people who need one of those rarely need all three.

Ask to see the permission model in detail rather than a summary. A product with coarse roles will force you to choose between people who cannot do their jobs and people who can see far more than they should.

Common questions

Is cloud payroll secure enough for sensitive data?

From a serious provider, generally more secure than a self managed server. The residual risk sits with your own accounts and your change controls.

What happens if the service is down on pay day?

Ask before signing. Good providers have a documented escalation and most outages are short, but the absence of a plan is itself the answer.

Where is payroll data stored?

Ask for the region and the sub processors. For multi country payroll this is a question with a different answer per country, and it should be in writing.

Do cloud based payroll services differ from the software itself?

Yes. With the software, your own team enters pay changes, approves each run and owns the filings, using the vendor's system. With a cloud based payroll service, the provider's staff run payroll for you on its platform. The verification questions on this page apply to both, but with a service also ask who at the provider can change payment details and how changes are confirmed.

How should I compare cloud based payroll companies?

On the controls on this page rather than the feature list: who can see pay data and whether that access is logged, whether multi factor authentication is required for anyone who can pay, the documented plan for an outage on pay day, where data is stored, and what you can export when you leave.

Coverage by country

• Employer of record vendors covering Singapore
• Employer of record vendors covering Mexico
• Employer of record vendors covering Spain
• Employer of record vendors covering Colombia
• Employer of record vendors covering United Kingdom
• Employer of record vendors covering France
• Employer of record vendors covering Hungary
• Employer of record vendors covering New Zealand