Paystub Printer Permissions and Confidentiality

The Paystub Printer is one of the most restricted tools in AccuArk because paystubs contain highly sensitive employee compensation data. This article explains who has access, why access is limited, how to grant access when needed, and best practices for handling printed paystubs.

Permission Requirement

The Paystub Printer requires the TOOL_PAYSTUB_PRINTER permission. This permission is assigned to Manager and above (hierarchy level 3 and higher) by default. Unlike the Check Printer, the Accountant role does not receive this permission by default.

If a user does not have the TOOL_PAYSTUB_PRINTER permission, the Tools > Paystub Printer menu item will be hidden or disabled. The user will not be able to open the Paystub Printer window.

Why Highly Restricted

Paystubs contain the most sensitive employee data in the system. A single paystub reveals:

• Individual salary amounts — how much the employee earns per pay period and annually
• Tax withholdings — federal and state tax amounts that can reveal filing status and allowances
• Benefit costs — what the employer contributes toward the employee's health, dental, vision, and life insurance
• Deduction details — retirement contributions, garnishments, union dues, and other personal financial obligations
• Social Security information — FICA withholdings tied to the employee's identity

Exposing this information to unauthorized individuals violates employee privacy and can create workplace conflicts. Limiting access to only those who need it protects employees and complies with confidentiality best practices.

Who Has Access by Default

The following table shows which roles receive the TOOL_PAYSTUB_PRINTER permission in the default role configuration:

Super Admins, Location Admins, and Managers have access because they are responsible for managing employees and may need to print paystubs as part of payroll processing. Employees do not have access because they should not be able to view other employees' compensation data. Accountants do not have access by default because the Accountant role is designed for financial record-keeping, not payroll distribution.

Granting Access to Accountants

If your accountant handles payroll processing and needs to print paystubs, an administrator can grant access in two ways:

Option 1: Role-Level Permission

Assign the TOOL_PAYSTUB_PRINTER permission to the Accountant role. This grants access to all users with the Accountant role across all locations. Use this approach when all accountants in your organization handle payroll.

Option 2: User-Level Permission Override

Grant the TOOL_PAYSTUB_PRINTER permission to specific users via location-level permission overrides. This grants access to only the specific accountant who handles payroll without affecting other users with the Accountant role. Use this approach when only certain accountants need paystub access.

Both options are configured through the role and permission management screens in AccuArk's administration area.

Confidentiality Best Practices

Following these practices helps protect employee privacy when printing and distributing paystubs:

1. Print in a Private Area

Do not print paystubs to a shared printer in an open office area where other employees can see the output. Use a printer in a private office, a locked print room, or a printer with secure print release that requires a PIN code to release the job.

2. Distribute Securely

Place printed paystubs in sealed envelopes before distributing to employees. Do not leave paystubs in open mailboxes, on desks, or in common areas where others could see them. If your organization has an employee self-service system, consider electronic distribution instead of paper.

3. Do Not Leave Stubs Unattended

If you print a batch of paystubs, collect them from the printer immediately. Do not walk away from the printer while paystubs are still in the output tray. Even a brief period of unattended paystubs at a shared printer creates a confidentiality risk.

4. Shred Incorrect or Unneeded Stubs

If a paystub was printed incorrectly, contains a typo, or is otherwise not needed, shred it immediately using a cross-cut shredder. Do not simply discard paystubs in a regular trash bin where they could be retrieved.

5. Limit Printing Access

Keep the number of people with TOOL_PAYSTUB_PRINTER permission to the minimum necessary. Only those directly responsible for payroll processing and distribution should have this permission. Review the permission assignments periodically and remove access from anyone who no longer needs it.

Employee Self-Service Alternative

Consider enabling employees to view their own paystub information through Program > My Profile rather than printing paper stubs for every employee. This approach offers several advantages:

• Reduced printing costs — eliminates the need to print, fold, and distribute paper paystubs for every pay period
• Improved confidentiality — each employee can only see their own information, and there is no paper to secure or shred
• Immediate availability — employees can view their paystub information as soon as the salary record is finalized, without waiting for physical distribution
• Historical access — employees can review past pay periods without requesting reprints from management

The self-service approach works well for organizations that want to reduce the operational burden and security risk of paper paystub distribution. You can still print paper stubs on request for employees who prefer them or for situations where a physical copy is needed.

Tips

• Review who has TOOL_PAYSTUB_PRINTER permission at least once per quarter. Remove access from anyone who has changed roles or no longer handles payroll.
• If you must print paystubs at a shared printer, use the printer's secure print or PIN release feature if available.
• Train new managers on paystub confidentiality requirements before granting them the permission.
• Keep a log of when paystubs are printed for audit purposes. AccuArk's activity logging can help track which users accessed the Paystub Printer and when.