Blog Post
I've just checked a dummy user account that is clearly not set for payroll, bank or accounts access and has no reporting function and YES, 100% if you go into the TRANSACTION JOURNAL, hit the ALL tab, it lists all payroll payments. I'm about to raise a ticket on this. Unbelievable privacy breach. Anyone who finds this in their file needs to raise a ticket before it becomes a HR nightmare!!
I've just spent some time in the user access permissions and found that under GENERAL, this can be disabled by deselecting the Transaction Journal - All tab.
I had assumed that if you didn't give someone payroll, accounts or banking access, there'd be no way they could see those transactions in the Transaction Journal. I had assumed that the All tab only showed the things they were permitted to see in a continuous stream.
Turns out the All tab is a separate beast entirely and lets everyone see everything unless you go and deselect it in the permissions. So it shows every account line in a payroll transaction for an employee, but when you go to drill further, it kindly says sorry, you don't have access. It shouldn't be this way. How many other companies will get caught by this?
