Security & data handling
How BOHO handles restaurant payroll and people data
Practices
What BOHO does
Secure exchange, never email
Employee data moves through the secure channel established at implementation. Payroll files, personnel records, and identity documents are not sent by email or text, in either direction — including by us.
Least privilege access
Access to your systems is scoped to what the agreed work requires, and is reviewed when your scope changes or when staffing changes on either side.
Multi-factor authentication
MFA is used on the accounts and platforms that hold your data, wherever the platform supports it. Where a system your restaurant uses does not support MFA, we will tell you.
Nothing sensitive in public forms
The contact form on this site asks only for business qualifiers — location count, headcount, pay frequency. It actively rejects submissions that look like they contain identifiers.
Documented retention and removal
How long records are held, and how they are returned or removed at the end of an engagement, is set out in your service schedule rather than left to custom.
Named incident contact
Your service schedule names who to contact if you suspect a data problem, and what happens next. Knowing that before you need it is the entire point.
Your side
What keeps the other half secure
- Keep your own payroll platform credentials private — BOHO will never ask you to email them.
- Tell us promptly when a manager leaves so their access can be removed.
- Confirm the identity of anyone requesting a change to bank details, by a channel other than the one the request arrived on.
- Keep physical personnel files secured at the restaurant, not in an office anyone can walk into.
What this site collects
The contact form collects the business qualifiers you type into it: your name, restaurant or group name, work email, optional phone, city, location and employee counts, current payroll setup, next pay date, whether you employ tipped staff, and anything you write in the message box. That is all.
The form is designed to reject submissions that appear to contain Social Security numbers or similar identifiers, rather than accept and store them. If you need to discuss something involving an individual employee, raise it on a call instead.
For what happens to that information afterwards, see the privacy policy. For where the boundary of the service sits, see the service scope.
Reporting a concern
If you believe information has been exposed, or you have received a suspicious request that appears to come from BOHO, raise it immediately at dmurphy@murphyaccounting.com. Report it even if you are not sure — a false alarm costs a conversation, and the alternative costs considerably more.
This page describes operating practice, not a warranty, certification, or guarantee of security outcomes. Specific obligations are those set out in your signed service schedule.
Ask how secure onboarding would work for you
Your restaurant remains the employer of record and approves payroll and employment decisions. BOHO is not a PEO, a staffing agency, or legal counsel.