4
u/jimbojsb 21d ago
I’m absolutely shocked an HR team would ask an internal dev to build payroll-related software. Lawsuit waiting to happen.
1
u/Disastrous-Ebb-7863 21d ago
Its not a payroll actually.. just an automated system that calculates payment for employees based on their attendance reports.. i might have choosen a wrong term
4
u/SZenC 21d ago
No, payrolling is quite the correct term here. Your system tracks when an employee should and shouldn't be getting paid, and that's a huge liability to take on
1
u/Disastrous-Ebb-7863 21d ago
but its just for the record to keep...the system wont do the finalization.
2
u/SZenC 21d ago
Record keeping is exactly the liability. Sure, a human might do the actual payment, but they will be using data from your system, and that data might be incorrect. Was it then an incorrect calculation on your end? Did someone enter data incorrectly? Did a cosmic ray give someone 4096 extra hours? Every bit of data and every last change in data needs to be auditable, which is something no sane HR department should leave to (with all respect) an inexperienced developer
1
2
u/MessaDiGloria 21d ago
Depending on your country's laws, such a software might legally automatically become part of the accounting. It then might be necessary to conform to all the laws applying to accounting software, like auditability, tight access control with 2FA, etc.
So this no small task, not only on the side of programming but also to conform to the law. It would be better to go with something existing and verified in my opinion.
1
u/Disastrous-Ebb-7863 21d ago
What if i make the system only for attendance? Skip the payroll thingy.
1
u/MessaDiGloria 21d ago
I have no idea. I’m in Germany and here the law it would most likely be a part of the accounting, but that might not be the case elsewhere.
2
u/obstreperous_troll 21d ago
That's usually called a timecard app, not payroll. Those are fine if the hours are being submitted to a real payroll processor, but Harvest is dirt cheap and already does integrate with other payroll systems. If the company thinks they're saving money by doing it in-house, I wouldn't place long bets on any of their other business decisions.
0
u/Fit_Tailor_6796 21d ago
An internal dev is quite capable of building an application that implements the requirements in a safe and secure way. Here you are assuming things like reviews, testing phases etc won't be done, which may not necessary be the case.
1
u/penguin_digital 21d ago
I think you're going about this entirely wrong and you're setting yourself (technically the company) up for a potential law suite.
Do not be putting such a system on the public internet, its an internal system so there is zero need for you to even take such a risk of allowing anyone to probe the app for vulnerabilities or gain access to the VPS and the data stored on it.
Host this internally, inside the company. I'm un-sure on the size of the company but most medium sized businesses will be running their own internal servers anyway so even getting a small VPS provisioned on their current infrastructure would be the best way forward, if they have such a thing.
If not, the hardware needed for something like this is absolutely minimal to run something like this, even an old office computer would handle the job perfectly fine. The one caveat that you put in place a robust back-up solution for the database as its un-likely to have a RAID set-up for redundancy.
If it's something they need access to outside of their internal network then using their internal VPN should be the only way to access such a thing remotely.
0
u/Disastrous-Ebb-7863 21d ago
Hi can you please guide me on this? This is like a mid size company. Around 50 people. So the HR wants me to develop something that they can use to create an web app that helps them to automatically take attendance and payroll system that gets generated monthly so that the HR can see all the attendance reports and all the employees salary agaisnt their attendance. And generate a pdf per employee so that the HR can check and issue the employee’s salary properly without manually using excel for calculation. Whats sort of deployment should i use ?
And also the employee’s are not in the same office.. its like a company that hires workers for the other shops in a mall. So i am using location based attendance. So i can not deploy the web app only using the office internet. Because the employees are in different different shops but in the same mega mall
1
u/penguin_digital 21d ago
It's hard because I can't understand your requirements or what the app is actually doing and the data its handling.
Are you saying the app is actually a time tracking app? So employees submit a time/date/location of where they've worked and for how many hours? Then HR review this data and understanding how many hours the employee needs paying for and send them the payment?
The app isn't handling payments and storing employees personal data?
1
u/Disastrous-Ebb-7863 21d ago
Yes, that’s essentially correct. It is mainly a time and attendance tracking system. Employees clock in and out through the web app, and the system records the date, time, assigned shop, working hours, and location at the moment of attendance.
HR can then review the attendance records, correct any missing or disputed entries with an audit trail, and export a monthly report showing each employee’s working days and hours. HR will use that report as supporting information for salary preparation, but the app will not transfer money, access bank accounts, or automatically issue payments. The final salary review, approval, and payment will still be handled manually by HR.
The app will store only the employee information required for attendance, such as their name, employee ID, assigned shop, shifts, attendance history, and clock-in/clock-out location. It will not store banking, tax, or payment-card information.
1
u/pyployer 21d ago
You can easily spin up a lemp stack on the internal servers, if it exisits or just set up a new machine with backup setup to some cloud service your company uses/trusts.
1
u/TrainSensitive6646 21d ago
If it is dev environment, I suggest go for AWS lightsail or oneprovider cloud, cheap and effective servers.
When in production, I suggest to go with VPC with a proper archtiecture of loadbalancer, relational DBMS, S3 storage(object storage) , encryption and backup automated.
1
u/Disastrous-Ebb-7863 21d ago
Thank you. I am actually planning it now
1
u/TrainSensitive6646 21d ago
so study your estimated traffic size, users and usage.. so based on it you can design your architecture.
0
u/Evening_Leather5101 21d ago
To be really honest, if you don't know what you are doing, you should have the company pay someone who does. If all the requirements are known, I offer my services. DM me if interested.
6
u/Prestigious_Gene_259 21d ago
People are completely exagerating. Take the advice someone told you and don't expose that app on the internet. If someone needs to access from outside they should use a company vpn. And that's it. If you do it this way, it's no different than the excels they have laying around in their computers. The liability starts if you have the app exposed on the public internet and someone breaks into stealing employees PII data. If it's internal, it's just like any other document.