Getting Every Employee Their Own Payslip
Most Kenyan employers have staff without company email, without a login, and sometimes without a smartphone of their own. Getting each of them their own payslip — and only their own — is a distribution problem before it is a payroll one. Here are both paths and the guard that matters most.
Payroll ends, in most organisations, with a printer and an awkward hour. Somebody prints forty payslips, folds them, and walks around the building handing them out — hoping nobody reads a colleague's on the way. Then three people ask for last March, one has lost every payslip they were ever given, and somebody needs a P9A for a loan application by Friday. None of that is a payroll calculation problem. It is a distribution problem, and it is the part of payroll most software quietly leaves to you.
The hard constraint in Kenya is that a large share of the workforce has no company email address and no reason to have a system login. Any answer that begins "each employee logs in" only covers half your staff.
Two paths, and most employers need both
Staff with a login
- An employee linked to a user account opens their own payslip list and any individual payslip, with a PDF of each.
- Their P9A tax certificate is there too, viewable and downloadable, without asking HR.
- Ordinary authentication and permissions — no extra credential to distribute or lose.
- Right for: office and supervisory staff who already sign in to do their jobs.
- The limit is simply that most of your workforce probably does not have an account, and giving everyone one is a licensing and administration decision rather than a small step.
Staff without a login
- A per-employee tokenised link, gated by a PIN. No account, no password, no licence.
- Reaches the same payslips and the same P9A — view and download — for that one employee only.
- The same token and PIN also open leave, time and support, so one credential covers four things rather than four credentials covering one each.
- Distributed as a printed QR code, individually or in bulk for a whole shift, or emailed to those who do have an address.
- Right for: production, field, retail and any workforce where a login per person makes no sense.
The bulk QR print is the underrated part. Onboarding a hundred people onto a portal is otherwise a hundred conversations; printing a hundred QR slips and handing them out with the payslips one final time is an afternoon. After that the printer stops being part of payroll.
The guard that matters more than the rest
Only finalised runs are exposed. A payroll that is still being prepared — approved by nobody, figures still moving — is invisible to employees, no matter which path they use.
This sounds like a small technicality and it is the single most valuable thing in the feature. Payroll is prepared in a state of flux: an allowance is queried, an attendance correction lands, a deduction was missed. Every organisation that has ever emailed a draft payslip knows what happens next — forty people have seen a number that is about to change, and each of them remembers the higher one. The guard removes the possibility rather than relying on nobody making a mistake at half past six on a Wednesday.
Rolling it out without an incident
-
Decide who needs a login and who needs a token
Not a technical decision — a cost and administration one. The usual split is that anyone who already signs in to work uses their login, and everybody else gets a token. Trying to give everybody accounts is what stalls this project in most organisations.
-
Enable it for a handful of people first, including a sceptic
Five employees, one of whom will genuinely try to see somebody else's payslip. That is a more useful test than any documentation, and it is far better to run it in week one than to discover the answer in month six.
-
Print the QR codes in bulk and hand them out with the last paper run
Pair the paper payslip with the QR slip once. People connect the two immediately, and the transition costs one cycle instead of a rolling six-month argument.
-
Set the PIN expectation explicitly and in writing
The PIN is theirs, it is not to be shared, and a supervisor asking for it is not a legitimate request. Say it once at the start, because the norm you set in the first month is the one you keep.
-
Tell people what they can now do without asking HR
Payslips, the P9A, leave, time and raising a support ticket. The point of the portal is the queries that stop arriving, and that only happens if people know it is there. An unannounced portal changes nothing.
The security questions, answered plainly
What protects a tokenised payslip link
These are the questions worth asking of any employee portal, including this one. The answers below are for this system.
Is the link alone enough to see a payslip?
Make them prove it: No — the link is gated by a PIN, so a forwarded or overheard URL is not sufficient on its own. This is the difference between a private link and an actual control, and it is where most "employee portal" implementations are weakest.
Is the PIN stored so nobody can read it?
Make them prove it: Hashed rather than stored in readable form, and legacy PINs from before that change were migrated. Ask any vendor this directly; a PIN an administrator can look up is a PIN that can be used by an administrator.
Can somebody guess a PIN by trying repeatedly?
Make them prove it: Lockout after repeated failures. A four-digit PIN with unlimited attempts is not a control at all, so this is the question that decides whether the whole model is sound.
Does access end when it should?
Make them prove it: Links carry an expiry, and access can be regenerated or disabled per employee — which is what makes offboarding real. Test it on a leaver during your first month rather than assuming.
Can an employee reach anybody else's record by changing the URL?
Make them prove it: The token resolves to one employee. This is the classic flaw in staff portals and worth verifying yourself: sign in as one employee and try to reach another's payslip by editing the address. We have tested this; you should too, on any system holding salary data.
Can an employee see a payroll that is not finished?
Make them prove it: No — only finalised runs are exposed. The most likely real-world incident is a draft figure being seen, not a break-in, and this is what prevents it.
What AWRA OpsHub does today
- Employees with a login can open their own payslip list, any individual payslip, a PDF of each, and their P9A certificate.
- Employees without a login reach the same through a per-employee tokenised, PIN-gated portal — no account and no licence.
- One token and PIN covers four employee portals: payslips and P9A, leave, time with clock-in and corrections, and raising support tickets.
- QR distribution, individually or printed in bulk for a whole workforce, plus emailing the link to those who have an address.
- PIN hashing, lockout on repeated failures, link expiry, per-employee regenerate and disable.
- Only finalised payroll runs are ever exposed, so a draft cannot be seen.
- P9A generation on both the employee side and the HR side, for any employee.
What it does not do
- No automatic payslip email on payroll finalisation. Nothing sends payslips out when a run completes; the portal is somewhere employees fetch from rather than a distribution engine that pushes.
- No SMS or WhatsApp notification that a payslip is ready, even though the system can send both for other purposes. Telling people it is payday is your process.
- No read receipts, so you cannot prove an employee opened their payslip.
- No password-protected payslip PDFs for onward emailing.
- No bulk payslip export as one file per employee for a third-party distribution tool.
- No employee-facing history beyond payslips, P9A, leave, time and tickets — this is not a full HR self-service suite.
The missing piece worth planning around is the absence of a push. Employees will not check a portal on a day they have no reason to think anything changed, so the first month typically sees low usage and a conclusion that the portal "did not work". One WhatsApp or SMS broadcast on payday — which the system can send — converts it from a page nobody visits into the thing that ends the payslip queue.
The number that justifies the setup
Count the payslip and P9A requests HR handles in one month, then multiply by the ten to fifteen minutes each actually costs once you include finding the run, checking the person is entitled to ask, producing the document and following up. In a hundred-person organisation this is routinely two to three days of somebody's month, spent entirely on retrieving documents that already exist. That is the return, and it arrives in the first cycle.
Our take
Use both paths: logins for staff who already sign in, tokenised PIN-gated links for everybody else, which is most of a Kenyan workforce. Print the QR codes in bulk and hand them out alongside the final paper run so the switch costs one cycle rather than six months. The guard that earns its keep is that only finalised runs are visible, because the realistic incident is a draft figure being seen rather than an intrusion. Then accept the one real gap and cover it with process: nothing pushes payslips, so send a single SMS or WhatsApp on payday or the portal will look like it failed when in fact nobody knew to visit it.
End the payslip queue
Own payslips and P9A for staff with a login, and tokenised PIN-gated portals for staff without one — with hashing, lockout, expiry, bulk QR distribution and finalised-runs-only exposure.
See plans & pricingFrequently asked questions
How do employees without a company login get their payslips?
Through a per-employee tokenised link gated by a PIN — no account, no password and no licence. It reaches their own payslips and P9A, view and download, for that one employee. The same token and PIN also open leave, time and support, so one credential covers four things. Distribute it as a printed QR code, in bulk for a whole workforce if needed.
Can an employee see a payroll run that is still being prepared?
No. Only finalised — approved or paid — runs are exposed, on both paths. This is the most valuable guard in the feature, because the realistic incident is not a break-in but a draft figure being seen while allowances and corrections are still moving. Everyone who has emailed a draft payslip knows that people remember the higher number.
What stops someone using a link they were not given?
The link alone is not enough — it is PIN-gated, so a forwarded URL does not open anything. PINs are hashed rather than stored readably, repeated failures trigger a lockout, links carry an expiry, and access can be regenerated or disabled per employee. The token also resolves to a single employee, so editing the URL does not reach a colleague's record.
Are payslips emailed out automatically when payroll is finalised?
No. Nothing pushes payslips on completion, and there is no SMS or WhatsApp notification that one is ready. The portal is somewhere employees fetch from. Plan for this: send one broadcast on payday — the system can send SMS and WhatsApp for other purposes — or the portal will see almost no traffic in month one and be judged a failure when the real problem is that nobody knew to look.
Can employees get their own P9A tax certificate?
Yes, on both paths — logged-in employees and tokenised portal users can view and download it, and HR can produce one for any employee. This is usually the second-biggest source of document requests after payslips, particularly around loan applications and filing season, so it removes a predictable annual crush.
Can we prove an employee received their payslip?
No. There are no read receipts, so you cannot demonstrate that somebody opened theirs. If you need acknowledgement for a specific reason — a disciplinary process, a disputed deduction — that stays a separate signed record, exactly as it was on paper.
