Your payroll data, and who can see it

Last Updated: June 30, 2026

I’m Curtis Cox. I run Cox Logistics, an active multi-station FedEx Ground operation, and I built RouteContractor Payroll to run my own Sunday payroll off the DSW files we already download. That’s the honest origin — and it’s also the thing a careful contractor should squint at. If the person who built the tool is a contractor like you, what stops him from reading your settlement numbers to sharpen his own routes?

The wrong answer is “trust me.” I didn’t want to ship a tool whose safety depends on my goodwill, because goodwill isn’t auditable and yours shouldn’t have to rest on it. So the firewall isn’t a policy I wrote — it’s how the system is built. The database itself blocks me from reading your data, and the rest of this page walks through exactly how, in plain terms, with the architectural fact under each one.

There’s a money reason the incentives line up, too. I charge one flat price per contract service area — $299 a CSA per month. I don’t bill per driver, per pay run, or per file you upload, and I don’t sell or mine your data because there’s nothing in it for me to. A bigger payroll week costs you the same as a small one. The only thing I’m paid to do is give you back your Sunday.

What I can and can’t see

The whole product is built around one rule: your workspace is sealed, and I’m on the wrong side of the wall to read it.

Your data lives in its own walled-off workspace. Every contractor’s data is isolated by Postgres Row-Level Security. Each record is tagged to one business, and the database refuses to return it unless the request has proven which workspace it belongs to. If that context is missing, the query fails shut — it errors out rather than guessing or leaking.

I can’t read your data, even with the database keys in hand. The app talks to the database as a restricted, non-privileged login with no permission to bypass that isolation. There is no “view as customer,” no impersonation, and no admin-read screen anywhere in the product — I never built one. Any query filters down to the one business that’s signed in.

A cross-workspace request doesn’t just get blocked — it gets logged. If anything ever tried to write into a workspace it didn’t belong to, the database rejects it and records the attempt to a tamper-resistant audit trail.

Where your data lives and who touches it

I’d rather tell you plainly than make a sweeping claim I’d have to walk back. Your payroll is processed on the server — that’s how a DSW file gets parsed into a register. Here’s the real map.

Your DSW file and your register go to private, per-business object storage (Cloudflare R2), and the server reads and parses them there. Both are encrypted in transit, and at rest with the storage provider’s standard encryption.
Your records — drivers, rates, pay runs, the audit trail — live in a Postgres database (Neon), under the Row-Level Security isolation above. Encrypted in transit; provider-standard encryption at rest.

A short list of outside services do narrow, specific jobs, and here is exactly what each one receives:

Billing (Stripe) — your subscription state and the email on the account. No driver names, no pay numbers, no settlement data.
Sign-in (Clerk) — your login and identity. Authentication runs through this service.
Truck-weight lookup (NHTSA vPIC) — only a VIN, to return a vehicle’s weight rating. No names, no pay, and VINs are never logged.
Handbook email (Resend) — standardized driver handbooks and signing links, addressed to each driver. To send a driver their signing link, this carries that driver’s name and email address. It never carries settlement or pay data.

No pay data — no pay figures, no settlement detail — goes to any of these. The one bit of driver identity that ever leaves is a recipient’s name and email on a handbook send (above), so their signing link reaches the right person. Otherwise what touches an outside service is billing state, your login, a VIN, and the handbook itself.

Your controls

You see every line before payday. This is a calculation layer: it reads your DSW, applies the pay rules you set, and hands back a register you review line by line. You run the actual payout through your own provider. Nothing pays out on its own.

It doesn’t move money or file taxes. By design, the product computes the gross-pay register and stops there. Disbursement and tax filing stay with you and your payroll provider — a smaller surface for your money to cross, because the tool never holds it.

You can take all of it back. Ask to delete your workspace and it’s fully removed — every record, every uploaded file, every generated register, and the audit rows along with them. The deletion is verified: it completes to zero residual data or it fails loudly. Want a copy first? Export your registers before you pull the plug.

What this isn’t, and the honest limits

I’d rather you know the edges than discover them.

It’s a calculation layer, not a payroll service. It computes the register; it doesn’t move money or file taxes. Keep your provider for that.
At-rest encryption is provider-standard, not field-level. Your data is encrypted at rest by Neon and Cloudflare using their standard encryption. I’m not claiming a custom or end-to-end scheme on top of that, because that’s not what’s running.
Scheduled expiry of old raw uploads isn’t automated yet. Full deletion is available on request today and removes everything; automatic expiry of old raw files is on the build list, not yet shipped.
Backups are still being hardened. Database backups currently live on my own machine, and moving them to off-site, encrypted storage is on the near-term roadmap.
I’ll keep this page current. If a new outside service ever needs to touch your data, I’ll update this page to say so.

Common questions

Can a competitor see my data in RouteContractor Payroll? No. Each contractor’s data is isolated by Postgres Row-Level Security, and the app runs on a non-privileged database login with no way to read across to another contractor’s workspace. There is no “view as customer” path in the product.

Does RouteContractor sell, share, or train AI models on my payroll data? No. Your payroll data — driver names, pay figures, settlement detail — is never sold, shared, or used to train models. Billing sees only your subscription and account email.

Can I delete my data? Yes. Full workspace deletion is available on request and removes every record, uploaded file, and generated register, verified down to zero residual data. Export your registers first if you want a copy.

That’s the whole picture — the wall, the short list of who touches what, and the limits I’m still closing. If it holds up for you, the rest is easy: create an account, drop in a DSW, and run a pay run. Your first six finalized pay runs are free, no card to start.

Run a pay run → · See pricing →

Questions about how your data is handled? Email customersupport@routecontractor.ai. See also our Privacy Policy and Terms.