Bhaviyo
Client governance workspace
Preliminary, for PendlePay review
A draft sales answer says customer data is never used for training, but LLM Provider A's contract and account settings have not been checked.
Why it matters
PendlePay could give the buyer an assurance it cannot support.
Preliminary, for PendlePay review
Approval of extracted fields is evidenced for standard upload only; bulk upload and API routes are unconfirmed.
Why it matters
PendlePay cannot yet show oversight across every route into payroll.
Preliminary, for PendlePay review
Product documentation calls tax-code suggestions advisory; marketing describes 'automatic tax-code correction'.
Why it matters
The buyer receives two different stories about the same feature.
Preliminary, for PendlePay review
Retention is documented for uploaded files only; prompts, AI outputs, debug logs and vendor retention are unmapped.
Why it matters
Privacy answers on retention are incomplete.
Preliminary, for PendlePay review
No named person approves AI-related statements made to customers and buyers.
Why it matters
Sales, product and engineering may give inconsistent or unsupported assurances.
Preliminary, for PendlePay review
The privacy assessment (Nov 2025) predates PaySense AI (Apr 2026) and does not cover the German pilot.
Why it matters
New processing, including German employee data sent to the US, has not been assessed.
| Impact: Low | Impact: Medium | Impact: High | |
|---|---|---|---|
| Likelihood: High | Medium High | High | |
| Likelihood: Medium | Medium Medium Medium | High High Medium | |
| Likelihood: Low |
Priority also reflects data sensitivity and the buyer deadline, so risks in the same cell can differ. All ratings are preliminary for PendlePay review.
Showing 9 of 9
| ID | Risk | Likelihood | Impact | Priority | Owner | Findings | Actions |
|---|---|---|---|---|---|---|---|
| PendlePay gives buyers an assurance on training use that it cannot support | High | High | High | CTO | |||
| Incorrect extracted data (including bank details) enters payroll without human review | Medium | High | High | Product Lead | |||
| Buyers receive conflicting descriptions of the tax-code feature | High | Medium | Medium | Product Lead | |||
| Retention of AI inputs, outputs and logs is unknown | Medium | Medium | Medium | CTO | |||
| No one approves AI-related statements made to customers and buyers | High | Medium | High | Operations Manager | |||
| AI processing and the German pilot are not covered by a current privacy assessment | Medium | High | High | Operations Manager | |||
| Key evidence documents fall out of date after product changes | Medium | High | Medium | Product Lead | None | ||
| Staff enter payroll or employee data into general AI tools | Medium | Medium | Medium | Operations Manager | None | ||
| AI provider changes alter how a feature behaves or handles data without PendlePay noticing | Medium | Medium | Medium | CTO | None |
PendlePay gives buyers an assurance on training use that it cannot support
Likelihood High · Impact High · CTO
Incorrect extracted data (including bank details) enters payroll without human review
Likelihood Medium · Impact High · Product Lead
Buyers receive conflicting descriptions of the tax-code feature
Likelihood High · Impact Medium · Product Lead
Retention of AI inputs, outputs and logs is unknown
Likelihood Medium · Impact Medium · CTO
No one approves AI-related statements made to customers and buyers
Likelihood High · Impact Medium · Operations Manager
AI processing and the German pilot are not covered by a current privacy assessment
Likelihood Medium · Impact High · Operations Manager
Key evidence documents fall out of date after product changes
Likelihood Medium · Impact High · Product Lead
Staff enter payroll or employee data into general AI tools
Likelihood Medium · Impact Medium · Operations Manager
AI provider changes alter how a feature behaves or handles data without PendlePay noticing
Likelihood Medium · Impact Medium · CTO