Is it safe to upload your payslip?

Every page written about payslips and privacy is written for the employer — whether a company may email payslips to staff, and how. If you are the employee, and a letting agent, a lender, a broker or a benefits portal has asked you to upload three of yours, that advice answers a different question. Yours is: does this recipient need the whole thing, and what is on a payslip besides the pay? The answer to the second is more than most people expect, starting with your National Insurance or Social Security number. SCRUB and SEAL take things out properly — SEAL rebuilds a PDF page from pixels so nothing survives under the box — and neither uploads the file.

What is on a payslip

People picture the net figure. The document carries considerably more, and most of it is identity rather than money:

• Your National Insurance number (UK) or the last digits of your Social Security number (US). This is the single most valuable field on the page and it is printed as a matter of course.
• Your payroll or employee number, which is a durable identifier inside your employer's systems.
• Your full name and home address, often exactly as held on the HR record.
• Your tax code and cumulative year-to-date figures, which say far more than one month's pay: total earnings, total tax, and often a second employment or a benefit if one exists.
• Deductions by name. This is the quiet one. A union subscription, a court-ordered attachment of earnings, a student loan plan number, a pension scheme, childcare vouchers, a charitable give-as-you-earn, a season ticket loan, a salary sacrifice for a medical scheme. Each is a fact about you that has nothing to do with whether you can pay the rent.
• Your employer's PAYE reference and their address.
• The file's metadata, if it is a PDF from a payroll system: the producing software, timestamps, and sometimes an internal batch or employee reference. X-RAY shows it.

Who is asking, and what they need

The top row again: do not redact a payslip for a regulated lender. Affordability checking is a legal process, the figures are cross-checked against the bank statements you also sent, and an altered document is a much worse problem than whatever you wanted to remove.

The second row is where most of these requests actually come from, and where the deductions list matters. A letting agent needs to know your income covers the rent. They do not need to know that you pay a union subscription, that there is an attachment of earnings against you, or which pension scheme you are in — and in several countries at least one of those is information an employer would be prohibited from volunteering about you.

Redacting one properly

1. Keep the original. Redact a copy.
2. Always remove the National Insurance or Social Security number. Nobody in the middle rows of that table needs it, and it is the field that makes the document useful for impersonation.
3. Consider the deductions block line by line rather than as one thing. The gross, the tax, the net and the period are what proves income; the named deductions rarely are.
4. Use something that removes rather than covers. SEAL rebuilds each page of a PDF from painted pixels, so the export has no text layer and nothing survives under a rectangle. A black box drawn in a viewer or an annotation app leaves the text selectable underneath, which is how this fails.
5. Check all three months, not just the first, and both sides if it is a double-sided scan.
6. Strip the metadata with SCRUB, or do the whole pass with CLEANROOM.
7. Read it back and try to select what you removed. If you can select it, it is still there.

The bit about email

This is what the existing advice is about, and it is worth a paragraph rather than a page. Ordinary email is readable at several points in transit and sits in two mailboxes indefinitely. For one payslip to a named person that is a risk many people sensibly accept. If you would rather not, put the file in an encrypted container and send the passphrase another way — CAPSULE makes one that opens in any browser, so the recipient installs nothing.

Where the organisation has a portal, use it. That single piece of the standard advice transfers to you unchanged.

And do not upload it to redact it

The ordinary route to blacking out a PDF is a website, which puts the complete unredacted payslip — National Insurance number and all — on somebody else's server before any of it is removed. Everything here runs in the tab you have open, which you can check in the browser's network panel or by turning the network off after the page has loaded.