PayCanvas treats payroll and its supporting evidence as private to each payroll account. Public support content and product diagnostics must never contain real employee identities, compensation values, private mappings, passwords, original provider responses, reports, or identifiable payroll results.
Prerequisites
- Use your own PayCanvas account; do not share credentials.
- Verify the payroll account name before reviewing or changing payroll data.
- Use MFA when connecting an MCP client.
- Keep original payroll files only in approved, account-specific storage and workflows.
How access is scoped
- Payroll records are scoped to one payroll account, and access follows your active membership in that account.
- PayCanvas checks account boundaries in both the application and database so sources, mappings, and calculations cannot be linked across accounts.
- PayCanvas exposes two customer roles: tenant administrator and payroll operator. Each supported action still checks its own role, account state, and deployment controls; membership alone does not enable every button.
How credentials and evidence are handled
- Configured source credentials stay on the server and are not returned through the public payroll connector.
- PayCanvas connects only to approved provider addresses and uses limited, configured collection workflows.
- Raw reports and original provider responses remain private to the payroll account.
- Calculations retain safe references and cleaned evidence needed to explain a result and reproduce it from the same inputs. Technical hashes confirm which versions were used.
MCP privacy boundary
The payroll connector requires secure PayCanvas sign-in, active account membership, and a six-digit authenticator code. Access is tied to the exact client and is checked again whenever it is used.
MCP tools return only authorized summaries, payroll lines, decisions, safe audit details, references, and cleaned source descriptions. They omit passwords, raw report contents, original provider responses and identifiers, private mappings and aliases, unrestricted source rows, and platform-only settings.
The public connector must not be used to request or send Social Security or other government identifiers, bank or routing information, payment-card data, health or benefits information, passwords, API keys, access tokens, authorization codes, MFA codes, raw provider credentials, or raw provider payloads. PayCanvas checks public MCP inputs and responses for these restricted categories and blocks a response instead of returning a detected restricted field or labeled value.
Internal IDs, timestamps, and hashes appear only where the assistant needs them to select the exact tenant-scoped record, order payroll history, prove immutable lineage, prevent stale writes, or produce an idempotent audit receipt. The assistant should keep opaque values internal unless a technical reviewer specifically asks for them.
Report a suspected exposure
- Stop sharing or downloading the affected material.
- Disconnect the involved MCP client if applicable.
- Record the payroll account, approximate time, screen or action, and safe error/reference code.
- Contact PayCanvas Support without attaching raw payroll files or credentials.
Expected result
The intended result is account-scoped access and a deliberately narrower public MCP data boundary. Still treat any unexpected account, raw source, credential, or restricted identity field as a security issue and stop the workflow.
Troubleshooting
- Data from an unexpected account appears: stop immediately, do not copy it, and contact support as a security issue.
- MCP returns
invalid_token: reconnect through OAuth; never paste a browser or bearer token into configuration. - A credential may be exposed: revoke or rotate it through the approved platform process and contact support.
- Need to share evidence with support: send sanitized references and error codes first; wait for an approved secure transfer path.