Pay accounts
Keep the bank and mobile money accounts each person is paid into, encrypted, with a fresh check before any change, the person told every time, and This wasn't me if it wasn't them.
Agoo is in early access. This page describes the feature as it ships to early-access organisations; screens are illustrative.
Changing where someone is paid is one of the easiest ways to steal their salary, so Agoo treats pay accounts more carefully than anything else on an HR record. Pay accounts are on every plan, on the person's HR record in Console → People and in My record in Agoo Workspace.
What's kept
Each person can be paid into up to three accounts:
| Kind | Details |
|---|---|
| Bank account | The bank, the branch, the name on the account and the account number (6 to 20 digits) |
| Mobile money | The network (MTN, Telecel or AT), the name the wallet is registered in and the mobile number |
With more than one account, give each its share of pay; the shares add up to 100%, such as 70% to the bank and 30% to MoMo.
Account numbers are encrypted as they're saved, like statutory numbers: everyone, the person included, sees the last four. Only the Owner and HR can see a full number, by giving a reason; it shows for 60 seconds, and Saw someone's full account number goes into the audit trail with the reason.
The same account can't be on two people's records by mistake. If two people really do share one, HR confirms that it's shared when they save it.
Who changes them
In Console → Settings → People and HR, Pay account changes decides who changes them:
- The person (default): they change their own in Agoo Workspace or the Console, and HR can too.
- HR only: people ask HR, who changes them for them.
Either way, every change needs the fresh check below, and the person is always told.
The fresh check
Before any pay account is added, changed or removed, Agoo checks that it's really the person (or HR) at the keyboard, even if they signed in hours ago:
- With an authenticator app on their account: a current code from it, entered in the last five minutes.
- Without one: a six-digit code Agoo emails them, typed in.
- In Agoo Workspace: their phone's own unlock first (Face ID, Touch ID or the passcode on iPhone and iPad; fingerprint, face unlock or the screen lock on Android), then the code.
A connected app or an API key can never change a pay account.
What people see
Changing where you're paid needs a quick check that it's you, and you'll get an email and a notification about it.
The person is always told
Every change, whoever makes it, sends the person Your pay account was changed by email and as a notification in Agoo Workspace, whatever their notification settings: it's a security notice that can't be turned off. It says what changed (never the number), when and by whom, with a This wasn't me button.
This wasn't me
If the person didn't make or expect the change, This wasn't me, in the email, the notification or My record:
- Holds all their pay accounts at once. Payroll pays into none of them while they're held.
- Signs them out everywhere else, so someone using their account loses it.
- Tells HR, who see Held on the person's accounts.
HR then checks the account with the person, by phone or in person, corrects it if it's wrong, and chooses Mark checked, which releases it: "Checked and released. Payroll can pay into it again." HR never checks their own accounts; another HR person or the Owner does. The person should also change their password and turn on two-step verification.
HR can mark any new account checked once they've confirmed it with the person, and the record shows when each was last checked.
In the audit trail
Changed someone's pay accounts (what changed, never the number), Saw someone's full account number, Checked someone's pay account and Said a pay account change wasn't them.
For payroll
Agoo Payroll, when it arrives, reads the accounts inside Agoo to make your bank and mobile money payment files, and never pays into an account that's held. Account numbers never go to webhooks, notifications, exports or the public API; the full organisation export has their last four only.
Job changes and history
Change someone's job from the date it takes effect, have line managers propose changes for HR to approve, and keep every change in a job history that's never rewritten.
Documents and expiry reminders
Keep each person's contract, particulars, licences, permits and certificates in an encrypted vault, decide who sees each kind, and remind people and HR before anything runs out.