Getting Every Employee Their Own Payslip
Most Kenyan employers have staff without company email, without a login, and sometimes without a smartphone of their own. Getting each of them their own payslip — and only their own — is a distribution problem before it is a payroll one. Here are both paths and the guard that matters most.
Payroll ends, in most organisations, with a printer and an awkward hour. Somebody prints forty payslips, folds them, and walks around the building handing them out — hoping nobody reads a colleague's on the way. Then three people ask for last March, one has lost every payslip they were ever given, and somebody needs a P9A for a loan application by Friday. None of that is a payroll calculation problem. It is a distribution problem, and it is the part of payroll most software quietly leaves to you.
The hard constraint in Kenya is that a large share of the workforce has no company email address and no reason to have a system login. Any answer that begins "each employee logs in" only covers half your staff.
Two paths, and most employers need both
Staff with a login
- An employee linked to a user account opens their own payslip list and any individual payslip, with a PDF of each.
- Their P9A tax certificate is there too, viewable and downloadable, without asking HR.
- Ordinary authentication and permissions — no extra credential to distribute or lose.
- Right for: office and supervisory staff who already sign in to do their jobs.
- The limit is simply that most of your workforce probably does not have an account, and giving everyone one is a licensing and administration decision rather than a small step.
Staff without a login
- A per-employee tokenised link, gated by a PIN. No account, no password, no licence.
- Reaches the same payslips and the same P9A — view and download — for that one employee only.
- The same token and PIN also open leave, time and support, so one credential covers four things rather than four credentials covering one each.
- Distributed as a printed QR code, individually or in bulk for a whole shift, or emailed to those who do have an address.
- Right for: production, field, retail and any workforce where a login per person makes no sense.
The bulk QR print is the underrated part. Onboarding a hundred people onto a portal is otherwise a hundred conversations; printing a hundred QR slips and handing them out with the payslips one final time is an afternoon. After that the printer stops being part of payroll.
The guard that matters more than the rest
Only finalised runs are exposed. A payroll that is still being prepared — approved by nobody, figures still moving — is invisible to employees, no matter which path they use.
This sounds like a small technicality and it is the single most valuable thing in the feature. Payroll is prepared in a state of flux: an allowance is queried, an attendance correction lands, a deduction was missed. Every organisation that has ever emailed a draft payslip knows what happens next — forty people have seen a number that is about to change, and each of them remembers the higher one. The guard removes the possibility rather than relying on nobody making a mistake at half past six on a Wednesday.
Rolling it out without an incident
-
Decide who needs a login and who needs a token
Not a technical decision — a cost and administration one. The usual split is that anyone who already signs in to work uses their login, and everybody else gets a token. Trying to give everybody accounts is what stalls this project in most organisations.
-
Enable it for a handful of people first, including a sceptic
Five employees, one of whom will genuinely try to see somebody else's payslip. That is a more useful test than any documentation, and it is far better to run it in week one than to discover the answer in month six.
-
Print the QR codes in bulk and hand them out with the last paper run
Pair the paper payslip with the QR slip once. People connect the two immediately, and the transition costs one cycle instead of a rolling six-month argument.
-
Set the PIN expectation explicitly and in writing
The PIN is theirs, it is not to be shared, and a supervisor asking for it is not a legitimate request. Say it once at the start, because the norm you set in the first month is the one you keep.
-
Tell people what they can now do without asking HR
Payslips, the P9A, leave, time and raising a support ticket. The point of the portal is the queries that stop arriving, and that only happens if people know it is there. An unannounced portal changes nothing.
The security questions, answered plainly
What protects a tokenised payslip link
These are the questions worth asking of any employee portal, including this one. The answers below are for this system.
Is the link alone enough to see a payslip?
Make them prove it: No — the link is gated by a PIN, so a forwarded or overheard URL is not sufficient on its own. This is the difference between a private link and an actual control, and it is where most "employee portal" implementations are weakest.
Is the PIN stored so nobody can read it?
Make them prove it: Hashed rather than stored in readable form, and legacy PINs from before that change were migrated. Ask any vendor this directly; a PIN an administrator can look up is a PIN that can be used by an administrator.
Can somebody guess a PIN by trying repeatedly?
Make them prove it: Lockout after repeated failures. A four-digit PIN with unlimited attempts is not a control at all, so this is the question that decides whether the whole model is sound.
Does access end when it should?
Make them prove it: Links carry an expiry, and access can be regenerated or disabled per employee — which is what makes offboarding real. Test it on a leaver during your first month rather than assuming.
Can an employee reach anybody else's record by changing the URL?
Make them prove it: The token resolves to one employee. This is the classic flaw in staff portals and worth verifying yourself: sign in as one employee and try to reach another's payslip by editing the address. We have tested this; you should too, on any system holding salary data.
Can an employee see a payroll that is not finished?
Make them prove it: No — only finalised runs are exposed. The most likely real-world incident is a draft figure being seen, not a break-in, and this is what prevents it.
What AWRA OpsHub does today
- Employees with a login can open their own payslip list, any individual payslip, a PDF of each, and their P9A certificate.
- Employees without a login reach the same through a per-employee tokenised, PIN-gated portal — no account and no licence.
- One token and PIN covers four employee portals: payslips and P9A, leave, time with clock-in and corrections, and raising support tickets.
- QR distribution, individually or printed in bulk for a whole workforce, plus emailing the link to those who have an address.
- PIN hashing, lockout on repeated failures, link expiry, per-employee regenerate and disable.
- Only finalised payroll runs are ever exposed, so a draft cannot be seen.
- P9A generation on both the employee side and the HR side, for any employee.
More we can add to your workspace
- An automatic payslip email on payroll finalisation, turning the portal from somewhere employees fetch from into a distribution engine that pushes.
- An SMS or WhatsApp notification that a payslip is ready. The system already sends both for other purposes, so this is wiring rather than new ground; telling people it is payday is your process today.
- Read receipts, so opening a payslip is provable.
- Password-protected payslip PDFs for onward emailing.
- A bulk payslip export as one file per employee for a third-party distribution tool.
- Employee-facing history beyond payslips, P9A, leave, time and tickets — this is not a full HR self-service suite.
The piece worth planning around is the push. Employees will not check a portal on a day they have no reason to think anything changed, so the first month typically sees low usage and a conclusion that the portal "did not work". One WhatsApp or SMS broadcast on payday — which the system can send today — converts it from a page nobody visits into the thing that ends the payslip queue.
Anything above that you need, we can build for you
Everything listed above as something we can add describes what ships in the standard product today — it is a starting point, not a limit on what AWRA OpsHub can do for your organisation. Kenya's eTIMS integration and its maintained payroll engine are both in the product because clients needed them and commissioned them; neither appeared by itself, and the same door is open for whatever you just read about. One qualification so this is worth what it claims: a small number of things on this blog we deliberately leave to a specialist rather than build — a statutory ledger we will not sign our name to, a rule that would decide a tax question for you, a clinical or member-funds record that belongs in a regulated system — and where that is true the post says so in those words. Everything else is a scope, a timeline and a price.
The operational work, which is what most commissions actually are
An extra approval stage in a chain that does not match the standard one, a custom field set on employees or assets that only your sector needs, an expiry that has to block an order rather than send an email, a report your board asks for in a shape nothing produces, or a scanner or weighbridge feeding the goods-in door. These are the commissions we are asked for most often and the smallest ones we quote — and unlike a revenue-authority pipeline, none of them waits on a regulator.
The module-shaped additions, which are the ones readers ask for most often
A price list with real discount authority, a customer-facing quotation that expires, a bill of materials or recipe costing, a staff advance that is issued, acquitted and chased, a member or unit ledger, a matching rule that holds a payment. Each of these is a build rather than a setting, and each has been quoted before — a bigger piece of work than a custom field, with a written spec and a date instead of a roadmap slide.
The report, document or pack nothing currently produces
The board pack in the shape your board actually asks for, a donor or funder layout, an invoice or receipt template carrying what your regulator or your customer expects, a dataset the report builder cannot reach yet. Usually the fastest thing on this list to deliver, because the data is already in the system.
Systems, rails and hardware you already run
The accounting package, CRM, online store, core banking or custom database you intend to keep — connected through our API so a fact is entered once and appears everywhere it is needed. Plus the physical edge: a scanner, a scale, a weighbridge or a till peripheral feeding the door it belongs to.
How it works: you describe the requirement, we return a written scope, timeline and cost, and once agreed it is built into your environment and maintained as part of the product. Nothing here waits on a regulator or a published specification, which is why operational builds are the ones we quote fastest. Tell us the requirement that would otherwise rule us out — that is a better first conversation than a demo.
Tell us what your operation needsThe number that justifies the setup
Count the payslip and P9A requests HR handles in one month, then multiply by the ten to fifteen minutes each actually costs once you include finding the run, checking the person is entitled to ask, producing the document and following up. In a hundred-person organisation this is routinely two to three days of somebody's month, spent entirely on retrieving documents that already exist. That is the return, and it arrives in the first cycle.
Our take
Use both paths: logins for staff who already sign in, tokenised PIN-gated links for everybody else, which is most of a Kenyan workforce. Print the QR codes in bulk and hand them out alongside the final paper run so the switch costs one cycle rather than six months. The guard that earns its keep is that only finalised runs are visible, because the realistic incident is a draft figure being seen rather than an intrusion. Then accept the one real gap and cover it with process: nothing pushes payslips, so send a single SMS or WhatsApp on payday or the portal will look like it failed when in fact nobody knew to visit it.
End the payslip queue
Own payslips and P9A for staff with a login, and tokenised PIN-gated portals for staff without one — with hashing, lockout, expiry, bulk QR distribution and finalised-runs-only exposure.
See plans & pricingFrequently asked questions
How do employees without a company login get their payslips?
Through a per-employee tokenised link gated by a PIN — no account, no password and no licence. It reaches their own payslips and P9A, view and download, for that one employee. The same token and PIN also open leave, time and support, so one credential covers four things. Distribute it as a printed QR code, in bulk for a whole workforce if needed.
Can an employee see a payroll run that is still being prepared?
No. Only finalised — approved or paid — runs are exposed, on both paths. This is the most valuable guard in the feature, because the realistic incident is not a break-in but a draft figure being seen while allowances and corrections are still moving. Everyone who has emailed a draft payslip knows that people remember the higher number.
What stops someone using a link they were not given?
The link alone is not enough — it is PIN-gated, so a forwarded URL does not open anything. PINs are hashed rather than stored readably, repeated failures trigger a lockout, links carry an expiry, and access can be regenerated or disabled per employee. The token also resolves to a single employee, so editing the URL does not reach a colleague's record.
Are payslips emailed out automatically when payroll is finalised?
No. Nothing pushes payslips on completion, and there is no SMS or WhatsApp notification that one is ready. The portal is somewhere employees fetch from. Plan for this: send one broadcast on payday — the system can send SMS and WhatsApp for other purposes — or the portal will see almost no traffic in month one and be judged a failure when the real problem is that nobody knew to look.
Can employees get their own P9A tax certificate?
Yes, on both paths — logged-in employees and tokenised portal users can view and download it, and HR can produce one for any employee. This is usually the second-biggest source of document requests after payslips, particularly around loan applications and filing season, so it removes a predictable annual crush.
Can we prove an employee received their payslip?
No. There are no read receipts, so you cannot demonstrate that somebody opened theirs. If you need acknowledgement for a specific reason — a disciplinary process, a disputed deduction — that stays a separate signed record, exactly as it was on paper.
