Last updated 9 September 2026. This describes what GovCertPay actually does with data — it is written to match how the service is built, not from a template.
GovCertPay is a certified-payroll compliance service operated by HighRock Holdings LLC. We prepare weekly certified payroll (Form WH-347) for construction contractors working on government-funded projects. Contact us at hello@govcertpay.com.
For the worker payroll data we handle, we act as a vendor processing data on the contractor’s instructions, not as the employer. The contractor decides what to send us and remains the employer of record. We process that data only to produce the certified payroll and compliance reports the contractor has engaged us to produce. We do not use it for any other purpose.
From the businesses we work with: company name, contact name, business email address, business phone number, project and contract details, and the wage determination that applies to the job.
From weekly timecards: each worker's name, the last four digits of their Social Security number, job classification, daily hours, base hourly rate, fringe benefit amounts, gross pay, and payroll deductions (federal withholding, state withholding, FICA, and other deductions). Some contractors also supply a worker's address and withholding exemptions, which appear on the WH-347 where required.
We do not store full Social Security numbers. Payroll exports from systems like ADP and Paychex frequently contain complete SSNs. When we read a file, any SSN longer than four digits is truncated to the last four before anything is written to disk. The full number is not stored, not backed up, and not printed on the form. Form WH-347 requires only the last four.
We hold this data to prepare and file certified payroll, to check pay against the applicable wage determination, and to maintain the records the law requires.
The Davis-Bacon regulations at 29 CFR 5.5(a)(3)(i) require certified payroll records to be preserved for at least three years after all work on the prime contract is completed — not from the date a subcontractor finishes their own scope, which can be much earlier. That is our retention period. Ohio Revised Code 4115.07 separately requires that records not be destroyed, and not be removed from the state, for one year after completion of a public improvement. Our three-year retention exceeds that duration; the in-state availability obligation runs to the contractor, who remains responsible for its own records. After the retention period ends, records are deleted. If a contractor asks us to delete their data sooner, we will — except where the retention requirement above still applies, in which case we will say so and explain when it lapses.
No system is perfectly secure, and we don't claim otherwise. We hold no third-party security certification such as SOC 2, and we will say so plainly rather than imply one.
We keep this list short on purpose:
We do not sell personal information. We do not share it for advertising. We do not use worker payroll data to train machine-learning or AI models. We disclose data outside the above only when the contractor directs us to, or when we are legally required to — and if we are compelled to disclose a contractor's records, we will tell them unless the law forbids it.
Certified payroll is a government filing. Once a WH-347 is submitted to a contracting agency or prime contractor, what happens to it is governed by that recipient's rules, including public-records law in some jurisdictions. That is outside our control, and it is a normal consequence of prevailing-wage work.
If you are a worker whose hours appear in a payroll we prepared and you want to know what we hold or want it corrected, contact your employer first — they are the controller of that record and can reach us directly. You may also write to us at hello@govcertpay.com and we will route your request to the right contractor and assist them in responding. Depending on where you live you may have rights to access, correct or delete personal information; we honour those requests through the contractor, and we do not charge for them.
If we become aware of a breach affecting payroll data, we will notify the affected contractors without undue delay, and in any event within 72 hours of confirming it, with what we know: what happened, what data was involved, and what we are doing about it.
This website sets no cookies and runs no analytics or tracking scripts. The client portal at portal.govcertpay.com sets a session cookie that keeps you signed in, and — for general contractors opening a dashboard link — one that remembers that link. Both are strictly necessary for the service and neither is used for advertising.
If we change this policy in a way that matters, we will update the date above and tell active clients by email. We will not apply a materially different use to data we already hold without asking first.
Questions about any of this: hello@govcertpay.com or (317) 316-2500.