Protect sensitive staff details
How X stores PAN, Aadhaar and bank details, which roles can see or change them, and what other roles see instead.
How they are stored
- PAN and bank Account number: stored encrypted. Screens show only the last 4 characters, such as "Account ending in 1234".
- Aadhaar: only the last 4 digits are kept. The full number is never stored.
- UPI ID, IFSC and the other bank details are kept with the bank account.
Who can see and change them
| Permission | Allows |
|---|---|
| View bank, PAN and personal details | See them on staff profiles and download the bank advice |
| Edit bank, PAN and personal details | Add and change them |
People without these permissions see "Personal, statutory and bank details are hidden for your role." on staff profiles. When they add staff, the form leaves these fields out.
Good practice
- Give these permissions only to the people who run payroll.
- Check the activity log for changes to bank accounts. Values stay hidden there too.
Related articles
Built-in roles
What the Owner, Admin, Branch manager, Attendance manager, Payroll manager, Accountant, Staff and Field staff roles can see and do.
Create a custom role
Build a role from exactly the permissions a person needs, such as a supervisor who marks attendance but cannot see salaries.
Download the bank advice
Download a CSV file of a finalised run's net pay with each staff member's bank details, ready to upload in your own bank's portal.
Still need help?
Write to us with your business name and what you were trying to do. We answer by email.