Visibility
Privacy comes from ledger stakeholders
Daml defines which parties are stakeholders of each record, and Canton serves each party only its authorized view. The app is not hiding public payroll data in the interface.
Who can see a salary receipt
| Viewer | Visibility |
|---|---|
| Employer | Receipts for its own payroll runs. |
| Employee | Only receipts addressed to that employee. |
| Active auditor | Receipts created while that grant is active. |
| Pending or revoked auditor | No new receipts. Previously disclosed records remain visible. |
| Unrelated party | No receipt because it is not a stakeholder. |
Forward-only audit access
Accepting an auditor invitation activates the auditor account and creates the grant together. Payroll settlement derives auditor stakeholders from active grant contract IDs. Revocation archives the grant and prevents future disclosure without rewriting history.
Rendering diagram...
Application privacy
Employee pages avoid Canton party IDs, contract IDs, and infrastructure language. Employer run detail keeps a collapsed technical section for support and integration verification. Email notices omit salary amounts.