Salary, bank and contact masking by role

How it works

1. In Access Control, open a role; the field masking panel shows three settings: salary, bank and contact.
2. Set each one to full, masked or hidden, and the change saves straight away.
3. Once enforcement is on, the employee list and profile show those fields according to the viewer's role.
4. Masked shows only the last four characters, such as ****4521 for an account number; hidden shows nothing at all.
5. The Company Head and Super Admin always see full values.
6. Data scope works alongside: scope decides which employees a role sees, masking decides which of their details.

What you can set

• Salary group: salary, CTC, gross, net and basic figures.
• Bank group: account number and IFSC.
• Contact group: phone, email and address.
• Levels: full, masked, hidden.
• Applied on the employee list and employee profile.
• Ready defaults: Manager and Auditor have salary and bank masked; other ready roles see full values.
• Takes effect when the company switches on enforcement.

Why mask instead of blocking the whole record

Blocking managers from employee records altogether pushes them back to asking HR for every phone number and joining date. Showing them everything puts salaries and bank accounts in front of people who do not need them, and salary gossip is one of the quickest ways to damage morale in an Indian workplace. Masking sits in between: the record stays useful, and the sensitive parts are covered. It also reduces the risk of bank details being misused if a login is left open on a shared computer.

Worked example: store managers in a retail chain

A clothing retailer with 22 stores in Tamil Nadu gives its store managers the Manager role with Hierarchy scope, so each sees the 12 to 18 people who report to them. Contact is set to full, so a manager can call a cashier who has not turned up. Bank stays masked, so the manager sees only the last four digits of an account number when a salary credit is queried. Because masked salary would still show the last four digits of the amount, the retailer sets salary to hidden for this role. The area HR executives use the HR role with full values, since they handle payroll queries and bank changes.

Choosing the right level

Pick the level for each field group by asking what the role needs to do its job. Start strict, since opening a field later is easy, while a salary figure that has already been seen by the wrong person cannot be unseen.

• Full for people who process pay or bank changes, such as HR and Finance.
• Masked for people who only need to confirm a value, such as the last digits of an account.
• Hidden for salary wherever a role should not know any part of the amount.
• Review contact masking for roles that could misuse personal phone numbers.

Frequently asked questions