9 MIN READ
UPDATED APR 10, 2026Product: Toku Stablecoin Payroll Last Updated: February 2026 Classification: Client-Facing / External Contact: [email protected]
1. Product Overview
Toku Stablecoin Payroll allows companies to settle payroll in stablecoins alongside traditional fiat payroll. The platform connects three enterprise systems through secure API integrations:
HRIS Platform (e.g., Workday, ADP, UKG) provides employee identity and compensation data.
Payroll Platform (e.g., ADP, UKG) provides per-cycle gross pay, net pay, deductions, and pay schedule data.
Custody Management Platform (e.g., Fireblocks, Coinbase Prime) provides wallet addresses, transaction proposals, and settlement confirmations.
Toku acts as an integration and orchestration layer. Toku does not take custody of funds, does not hold private keys, and does not have signing authority over client wallets. The client maintains full control of fund disbursement through their chosen custody provider's approval workflows.
Terminology Throughout this document, "stablecoin" refers to any cryptocurrency asset supported on the Toku platform, including any digital assets a client may configure for payroll settlement.
2. Data We Collect
This table covers every category of data Toku stores, where it comes from, why we store it, and how long we keep it.
| Data Category | Specific Fields | Source System | Purpose | Retention |
|---|---|---|---|---|
| Employee Identity | First name, last name | HRIS (Workday, ADP, UKG) | Match payroll records to custody transactions; display in admin dashboard | Duration of service + post-termination period per Toku's data retention policy |
| Employee Contact | Email address | HRIS | Platform login, notifications, pay stub delivery | Duration of service + post-termination period per Toku's data retention policy |
| Employee Address | Street address, city, state/province, postal code, country | HRIS | Tax jurisdiction determination, regulatory compliance, pay stub generation | Duration of service + post-termination period per Toku's data retention policy |
| Compensation | Base salary, compensation currency | HRIS | Stablecoin conversion calculations, deduction validation | Duration of service + post-termination period per Toku's data retention policy |
| Payroll Cycle Data | Pay period dates, gross pay, net pay, itemized deductions (tax, benefits, retirement), pay frequency | Payroll Platform | Calculate stablecoin settlement amounts, reconcile against HRIS records, generate pay stubs | Per Toku's data retention policy, aligned to applicable tax authority requirements |
| Wallet Addresses | Blockchain wallet address(es), network type | Custody Platform | Route stablecoin payments to verified employee wallets | Duration of service + post-termination period per Toku's data retention policy |
| Payment Records | Transaction hash, settlement amount, stablecoin type, timestamp, settlement status | Custody Platform | Payment confirmation, reconciliation, audit trail | Per Toku's data retention policy, aligned to applicable tax authority requirements |
| Authentication Data | Hashed password, MFA seed (encrypted), session tokens | Toku Platform | Secure platform access | Duration of account existence |
| Audit Logs | Login timestamps, IP addresses, actions performed, API calls | Toku Platform | Security monitoring, compliance auditing, incident investigation | Per Toku's data retention policy |
What Toku does not collect or store:
Toku does not store Social Security numbers or national tax IDs (these remain in the payroll platform). Toku does not store bank account or routing numbers. Toku does not store private keys or signing credentials. Toku does not store raw biometric data. Toku does not store custody platform login credentials.
3. Data Flow Architecture
3.1 Inbound Data (HRIS and Payroll to Toku)
Data syncs from HRIS and payroll platforms to Toku over encrypted API connections using OAuth 2.0 authentication. Each API credential is scoped to read-only access with least-privilege permissions. Syncs run on a scheduled cadence aligned to each client's pay cycle. No write-back occurs to the HRIS or payroll platform.
3.2 Outbound Data (Toku to Custody Platform)
Toku proposes transactions to the custody platform via authenticated API calls. Transaction proposals include the recipient wallet address, the stablecoin amount, and an internal reference ID. The client's custody platform requires the client's own approval (typically multi-signature or policy-engine approval) before any funds move. Toku's API credential cannot unilaterally execute transactions. Client approval is always required.
3.3 Data at Rest
All data stored within Toku's infrastructure is encrypted at rest. No employee, payroll, or wallet data is ever stored in plaintext.
4. Encryption Standards
4.1 Encryption in Transit
All data transmitted to and from Toku's platform is encrypted using TLS 1.3, covering browser sessions (admin dashboard), API-to-API integrations (HRIS, payroll, custody), internal service-to-service communication, and webhook/callback payloads.
Toku enforces a minimum of TLS 1.2 and rejects connections using deprecated cipher suites. HSTS (HTTP Strict Transport Security) is enabled on all public endpoints.
4.2 Encryption at Rest
All database records containing employee PII, compensation data, wallet addresses, and payment records are encrypted using AES-256 at the storage layer. File system encryption is enabled on all volumes hosting application data.
4.3 Key Management
Encryption keys are managed through the cloud provider's key management service with automatic key rotation. Application-level secrets (API credentials, integration tokens) are stored in encrypted secret management infrastructure and are never committed to source code, logged in application logs, or exposed in error messages. All API credentials for client integrations (Fireblocks, Workday, ADP, UKG) are stored encrypted and are rotated on a defined schedule or immediately upon any suspected compromise.
4.4 Hashing
Personal API tokens are hashed with SHA-256 before storage. Password reset tokens are generated using cryptographically secure random number generation (crypto.randomBytes), not pseudorandom functions.
5. Infrastructure Security
5.1 Hosting
Toku's production infrastructure is hosted on DigitalOcean within United States data center regions. DigitalOcean maintains SOC 2 Type II and SOC 3 Type II certifications. Each client's data is logically isolated at the database level.
5.2 Network Security
Cloudflare Web Application Firewall (WAF) is deployed on all application-layer traffic, providing DDoS mitigation, bot detection, rate limiting, and request inspection. Network segmentation isolates production, staging, and development environments. Direct database access from external networks is not permitted.
5.3 Endpoint Security
CrowdStrike Falcon is deployed across all employee endpoints for real-time threat detection, endpoint detection and response (EDR), and managed threat hunting. Jamf is deployed for device management, configuration enforcement, and OS patch compliance on all company-managed macOS devices.
5.4 Monitoring
Toku uses Sentry for error tracking and PostHog for product analytics (PII is excluded from PostHog). All access to sensitive data is logged. Authentication events (successful and failed logins, password resets, MFA enrollment) are logged with timestamps and source IP addresses. Integration API calls are monitored with automated alerting on failures or anomalies.
6. Application Security
6.1 Authentication
Toku's authentication is managed through PropelAuth, which supports SAML 2.0 SSO with enterprise identity providers including Okta, Azure AD, Google Workspace, and OneLogin. SSO is included at no additional cost. Multi-factor authentication (MFA) is enforced using TOTP-based verification, and MFA checks run before any session-level authorization.
6.2 Session Management
Session tokens are invalidated immediately upon password reset. Password reset tokens expire within 24 hours and are single-use. Old password reset tokens are automatically invalidated when a new token is generated. Rate limiting is enforced on all authentication endpoints, including password reset and MFA verification.
6.3 Access Control
Role-based access control (RBAC) is enforced throughout the platform. Client administrators can only view and manage data for their own organization. Toku internal access follows the principle of least privilege. All internal access to production data is logged and auditable.
6.4 Secure Development
Toku brings in third-party firms for security audits (most recent: Quantstamp, 2026). All audit findings are tracked to resolution with associated code changes reviewed and merged. Dependency scanning monitors for known CVEs across the application stack. Code changes require peer review before merging to production.
7. Client Data Control
7.1 What Clients Control
Clients control the following:
Integration connectivity. Clients provision and revoke API access to their HRIS, payroll, and custody platforms. Toku cannot access these systems without client-issued credentials. If a client revokes API access, data synchronization stops immediately.
Employee enrollment. Clients determine which employees are enrolled in stablecoin payroll. Toku does not add employees to the platform without client authorization.
Transaction approval. All stablecoin disbursements require client approval through their custody provider's policy engine. Toku proposes transactions. The client approves and executes them. This is enforced at the custody platform level, outside of Toku's infrastructure.
Data retention requests. Clients may request deletion of their organization's data in accordance with applicable data protection regulations (GDPR, CCPA/CPRA). Deletion requests are confirmed in writing and processed per Toku's data retention policy.
Audit access. Clients may request audit logs of all platform activity associated with their organization, including admin actions, data access events, and integration activity.
7.2 What Clients Do Not Need to Manage
Toku handles encryption, infrastructure patching, security monitoring, and incident response. None of these require client configuration or action.
8. Compliance Framework
| Regulation | Applicability | Toku Posture |
|---|---|---|
| GDPR (EU/UK) | Employees in EU/UK jurisdictions | Data Processing Addendum (DPA) available; data minimization enforced; right to erasure supported |
| CCPA/CPRA (California) | California-resident employees | Service Provider Agreement available; no sale of personal information; deletion rights supported |
| SOX (US) | Publicly traded clients | Audit trail integrity maintained; separation of duties enforced in payment workflows |
| PCI DSS | Not applicable | Toku does not process, store, or transmit payment card data |
9. Frequently Asked Questions
Does Toku have access to our funds? No. Toku operates on a strict non-custody model. Toku proposes transactions to your custody provider. Your team approves and executes disbursements using your custody provider's signing and approval infrastructure. Toku never holds private keys or signing authority.
Can Toku employees see our employee data? Access to client data is restricted by role-based access control. Only authorized Toku personnel with a documented business need can access client data, and all access is logged.
What happens if we want to stop using Toku? You revoke API credentials on your HRIS, payroll, and custody platforms, which cuts off data flow immediately. You can then request full deletion of your organization's data per Toku's data retention policy.
Do you process our data using AI or machine learning? Toku does not process employee PII or client proprietary data through AI systems. We use AI internally for development workflows and for processing regulatory and tax reference data only.
How do you handle data for employees in multiple jurisdictions? Toku applies the data protection requirements of each employee's jurisdiction. GDPR applies for EU/UK employees. CCPA/CPRA applies for California employees. Where local requirements are stricter than Toku's standard retention policy, the local requirements take precedence.
Can we conduct our own security assessment of Toku? Yes. We support security questionnaires, vendor risk assessments, and can share our most recent third-party audit report, Data Processing Addendum, and infrastructure security documentation on request. Reach out to [email protected].
Document Version: 3.0 Effective Date: February 2026 Next Review: October 2026 Contact: [email protected]