Account settings

Account settings cover the organisation-level choices FairCheck makes on your behalf: the account's name and avatar, how long payslip data is kept, whether scanned originals are retained, how patiently the hours-request chain waits, the pseudonym key used for in-browser redaction, and who owns the account. Most of it lives under Edit Account; the data-retention promise is also shown read-only on the account page for every member.

Only account admins can open Edit Account or change any of these settings. The account owner is always an admin (see Team members).

Accounts

The Accounts page lists every account you belong to, with a Personal badge on your personal account and the number of users in each. The account you are working in shows a Current Account badge; every other row has a Switch button. Switching changes which account's payslips, employers and settings you see.

Create an Account opens New Account — "Collaborate and share with others by creating an account." Give it a name and save; you are switched to it straight away.

A personal account is private. As the account page says: "Your personal account is private. Create a new account to share with your team." A personal account cannot be deleted and has no members table.

Click an account's name to open its page. From there, admins of a team account see Edit Account; and every admin, including on a personal account, sees a Change button on the Data retention card.

Name and avatar

On Edit Account:

• Name — the account's name, shown in the account switcher and the settings breadcrumb.
• Avatar — an image in PNG, JPEG, HEIC, HEIF or WebP. You can drop a file onto the field.

Click the save button to apply. The remaining settings on the form only appear once the account has been saved, because there is nothing being retained yet on a brand-new one.

What does your business do?

On Edit Account, pick what the business does from the list (a shop, a café or restaurant, trucking or freight, aged care, and so on). The award usually comes from the business, so the awards your answer points at are offered as a lead whenever someone's award is worked out. Each person still confirms their own award.

If you look after several businesses (a bookkeeper or bureau), set each one's type on its employer page instead. An employer with its own type ignores the account's. Until this is answered, the dashboard asks.

Keep payslip data for

Choose how long uploaded payslip data is held: 7 days, 14 days, 30 days, 60 days, 90 days, 180 days or 365 days. The default is 30 days, which is the promise made in the Privacy Policy.

As the form explains: "Uploaded payslips, the details extracted from them, the identities behind the placeholders and any retained scanned original are deleted this many days after upload. The compliance result and its audit record are kept — they hold no personal data."

What the nightly sweep removes when a payslip reaches its date:

• the submitted payload and the extracted details
• the map from placeholders back to real names
• the uploaded document, and any extracted or filtered text
• audit records that quote the payslip's text
• the artifacts of any period report that covered the payslip (the report row and its non-PII summary survive)

Any public share link minted from that payslip's result is also switched off at the same time. The compliance run itself stays readable in the app.

The direction of a change matters. "Reducing this deletes older payslips at the next nightly sweep; increasing it applies to new uploads only, so a payslip we promised to delete on a given date still goes on that date." Shortening pulls every existing payslip's expiry down to the new window; lengthening never extends one that has already been promised.

Keep scanned originals so they can be re-read with AI

Scanned payslips are read by text recognition on FairCheck's own servers, which "struggles with faint print and handwriting." Ticking this box keeps the original scan, encrypted, for the retention window above, so someone can ask for it to be re-read by an AI model when the details come out wrong.

Turning it off deletes the originals FairCheck currently holds and removes the re-read option. Payslips read from a PDF's own text layer are unaffected either way — their originals are deleted the moment they are read.

Wait before asking the next person

When a pay run has no hours for someone, FairCheck asks you first, then their manager, then the person. This setting is how long each gets before FairCheck moves on: 4 hours, 8 hours, 12 hours, 24 hours, 48 hours or 72 hours.

The last step doesn't expire. As the form says, "an unanswered request is still someone whose pay can't be checked, so it stays on the pay-run screen until it's answered or waived." See Check a pay run.

Pseudonym key

When an uploader chooses to redact a payslip in the browser using text mode, names, the employer and payroll references are replaced with pseudonyms derived from this key, so the same person gets the same pseudonym across uploads. Drawing boxes over a scan does not use it.

The key is held by your organisation. FairCheck keeps only a fingerprint of it — enough to tell a browser whether it has the current key, never enough to reverse a pseudonym. The card shows when the key was generated, or Not generated.

• Generate key creates the first key. The confirmation warns: "The key is shown once. Save it somewhere your uploaders can reach — FairCheck cannot show it again."
• Rotate key replaces it. "A new key gives every person a new pseudonym, so payslips uploaded after this will not be grouped with the ones uploaded before it. The key is shown once; everyone who uploads will need the new one."

Either action opens the Pseudonym key page, the one time the key exists in clear: "Copy or download this key now. FairCheck keeps only a fingerprint of it and cannot show it again." Use the copy button or Download key file, then give the key to everyone who uploads payslips for the account. If the key is lost, rotate it.

Data retention

The account page shows a read-only Data retention card to every member, admin or not, because it is a promise the account has made about other people's payslips. It states:

• "Payslip data is deleted N days after upload."
• whether scanned originals are "kept for that window, so they can be re-read with AI if the text recognition gets them wrong" or "deleted as soon as they're read"

Admins see a Change button that opens Edit Account.

Transfer ownership

On Edit Account, the account owner of a team account with at least two members sees Transfer ownership — "Transfer ownership of this account to another user." Pick a member from the list and click Transfer; the confirmation asks "Are you sure you want to transfer this account?"

The new owner is automatically granted admin access. The previous owner keeps whatever roles they had.

Deleting an account

A team account can be deleted from Edit Account with the Delete button. The confirmation reads "Deleting this account will permanently remove all associated data." Personal accounts cannot be deleted — trying returns "You cannot delete your personal account."

Deletion is treated as an erasure request, and the erasure happens before the account's records are removed:

1. Every payslip that still holds personal data is purged, exactly as it would be at the end of its retention window.
2. Report artifacts are purged, leaving only their non-PII summaries.
3. Every public share link minted from the account's results is switched off.
4. Employee and manager contact details used by the hours-request chain are purged.
5. Names and free text that the account's own key does not protect — employee and manager names, employer names, ABNs and trading names, employer policy text, enterprise agreement text, feedback notes, triage notes and attestation attributions — are cleared outright.
6. The account's own encryption key is destroyed, so anything that was encrypted with it — payslip identity maps, document blobs, report artifacts, chat identity maps — becomes unreadable ciphertext.

Destroying the key binds every backup taken after that point. A backup taken before deletion still holds both the ciphertext and the key, so that data can surface if such a backup is restored, until the backup ages out.

Deleting your own user login is a different action — see Your profile.