Data Flows
- Solid = evidenced
- Dashed = not evidenced
- Unknown Amber = unknown retention or vendor training
- Globe = leaves the UK
Payroll anomaly detection
Steps (4 of 13)
| ID | Step | From | To | Data | Location | Retention | Vendor training | Evidence | Basis | Gap | Requests | Findings |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1 | Customer payroll team | PendlePay platform | Pay-run data: salary; deductions; payment history | PendlePay hosting – to confirm | General payroll records – outside AI scope | Not applicable – in-house | Evidence-supported | Hosting location (RQ-09) | None | |||
| 2 | PendlePay platform | Anomaly model (in-house) | Pay-run data | Inside PendlePay – does not leave | Not separately documented | Not applicable – in-house | Evidence-supported | — | None | None | ||
| 3 | Anomaly model | Review list → payroll user | Flags | Inside PendlePay | Not documented | Not applicable | Evidence-supported | — | None | None | ||
| 4 | Payroll user | Activity record | Dismissal decision with user and time | Inside PendlePay | Not documented | Not applicable | Client-reported | Proof of dismissal records (RQ-07) | None |