AI ≠ calculator
AI can extract, classify and explain. Deterministic code calculates monetary results inside an approved envelope.
WageRun Trust Centre
Evidence before status.
Payroll trust comes from explicit authority, reproducible rules and external receipts—not from a confident interface.
Current service posture
Pre-production is a state, not a euphemism.
WageRun is executing a gated production programme. This public site is live infrastructure; the payroll platform is not yet open for production customer operation.
Live
Public website and company email
Public information and mail routing only. They do not create payroll authority.
Local
Product and evidence foundations
Extensive deterministic, database, API and rendered-surface tests exist locally with explicit production limits.
Gate
South African calculation authority
Requires current approved sources, signed representative corpus, independent outputs and qualified approval.
Gate
Production payroll and external close
Requires hosted identity, real providers, authorised close evidence, design-employer cycles and release approval.
Four separations
The controls are designed around what must never blur.
Draft ≠ approval
A prepared input, artefact or case remains pending until an authorised named person acts.
Submission ≠ result
Handoff, acknowledgement, acceptance, payment and reconciliation each need their own evidence.
Local ≠ production
A passing local test does not establish hosted identity, provider operation, customer use or regulatory approval.
Security and privacy posture
Minimum data, exact purpose, separate authority.
The production design uses tenant isolation, immutable evidence, least-privilege roles, explicit AI egress policy and worker access/correction paths. Production controls still require hosted and independent qualification.
Designed controls
- Forced tenant isolation at the data layer
- Append-only evidence and correction history
- Hash-minimal operational telemetry
- Deny-by-default AI provider gateway
- Break-glass and incident evidence paths
Launch evidence still required
- Independent penetration and privacy review
- Production identity and MFA operation
- Hosted backup, restore and incident exercise
- Approved retention and legal-hold schedule
- Named accountable operating rota
Report responsibly
Found a security concern?
Please send a concise description, affected URL, reproduction steps and impact to security@wagerun.co.za. Do not include real payroll or worker data in an unsolicited report.