Data Encryption and PAN Handling

What is encrypted

• PAN and similar sensitive identifiers on a client’s practice profile are encrypted before they are saved.
• Credentials you give Oris Work to connect other services — your own SMTP password for email sending, email and calendar connection tokens, and payment gateway keys — are stored encrypted.
• Two-factor authentication secrets are stored encrypted.
• Account passwords are never stored as plain text; they are stored as salted one-way hashes. The same applies to API keys and password-reset tokens, so even Oris Work staff cannot read them back.

How PAN is handled

• You can record a client’s PAN on their practice profile. It must be in the format AAAAA9999A (five letters, four digits, one letter).
• It is shown in full only to signed-in staff whose role allows reading the client’s practice profile.
• It is used to fill engagement letters you generate for that client.
• In payroll, once a PAN is saved the screen shows only the last four digits as a placeholder.

Access is logged

Each time a client’s PAN is read for a profile view, an engagement document view or an engagement-letter generation, Oris Work writes an entry to a PII access log: which field, who accessed it, in which workspace, and for what purpose. The log stores a non-reversible fingerprint of the value, never the PAN itself. Logging is best-effort and never blocks the read. There is no screen for this log in the app today.

Exports never include PAN

The Clients export deliberately leaves PAN out. If you need PAN for a purpose, open the client and read it there, where access is logged.

Good practice

• Put PAN in the PAN field, not in notes, activity text or file names. Those free-text places are not encrypted.
• Give Read access to client practice profiles only to the roles that need it (see Custom Roles).
• Turn on two-factor authentication for yourself and consider requiring it for all members.