Plain answers about where data lives, who can see it, and what we would do if something went wrong. Ask for the documents behind any of it.
In the United States, in AWS. Encrypted at rest (AES-256) and in transit (TLS 1.2+). Backups daily, kept 35 days.
Verification staff see only the employee record a request needs, only while they work it. Every view is logged. Access is removed the day someone leaves.
Through Finch, read-only. We never hold your payroll login. You can revoke access from your HRIS at any time and we lose it immediately.
Every verifier states a purpose and is matched against a business record before we answer. Income goes out only on the employee's written authorization or salary key. Requests that don't qualify are declined and logged.
Only the verifier who made a qualifying request, limited to what that request needs. Every disclosure is in your log and the employee's. Subprocessors are listed below.
We notify affected clients within 72 hours of confirming an incident, with what happened and what we did. Security contact: security@smithdalerecords.com.
Updated November 2026. Clients are emailed 30 days before any addition.