# Trust and security

> What PayCaptain does to protect payroll data, and what your integration must do.

## Shared responsibility

Payroll data is personal and financial. An integration is only as trustworthy as its weakest side, so the responsibilities are split plainly.

| PayCaptain | Your integration |
| --- | --- |
| HMRC-recognised payroll software | Sends only PAYE employees, with complete and valid data |
| ISO 27001 and Cyber Essentials Plus certified | Keeps the API key secret and server-side |
| Core software operated by PayCaptain UK personnel | Controls who can view data and trigger API calls |
| HTTPS on every endpoint | Enforces TLS 1.2 or higher and encrypts stored data |
| Publishes every rule on this site | Validates against those rules before sending |

## API keys

Your API key authenticates your application to PayCaptain. Treat it as a privileged credential.

> **Must** The API key is a secret. It must never be visible to end users.

- Store the key in a secrets manager or environment variable. Never hard-code it.
- Call the API from your server only. Never from a browser or a mobile app.
- Keep the key out of client-side code, app bundles and every log.
- No end user of your application may view, retrieve or export it.
- If you suspect a compromise, rotate the key and tell [developer@paycaptain.com](mailto:developer@paycaptain.com) immediately.
- Keep an audit log of every API call: timestamp, endpoint, and the user or process that triggered it.

## Data protection

Your application handles employee personal data as a data processor under UK GDPR. These are legal obligations, not recommendations.

| Principle | What you must do | Reference |
| --- | --- | --- |
| Data minimisation | Collect and send only the fields your integration needs. | UK GDPR Art. 5(1)(c) |
| Purpose limitation | Use the data for payroll processing only. | UK GDPR Art. 5(1)(b) |
| Encryption in transit | Enforce TLS 1.2 or higher on all API traffic. | ISO 27001 A.10 |
| Encryption at rest | Encrypt stored employee data with AES-256 or equivalent. | ISO 27001 A.10 |
| Access control | Use role-based access. Only authorised people and processes see data or trigger calls. | ISO 27001 A.9 |
| Retention | Keep employee data no longer than necessary. | UK GDPR Art. 5(1)(e) |
| Breach notification | Tell PayCaptain within 24 hours of any breach affecting data sent to or received from the API. | UK GDPR Art. 33 |
| Right to erasure | Be able to delete an individual's personal data on request. | UK GDPR Art. 17 |

## Compliance

API calls that do not meet the rules on this site are rejected. Repeated non-compliance may lead to API access being revoked. The [compliance tests](https://developer.paycaptain.com/testing) let you prove your integration meets every rule before it goes live.

## This site

This site sets no cookies, runs no analytics and loads nothing from third parties. Fonts, styles and scripts are served from the same origin under a strict Content Security Policy.