Toast Payroll: Manage Security Roles

In this Article:

Review Security Roles
Standard Security Roles
View or Adjust a User's Security Role
Custom Security Roles
Security Role Access For Pay Changes
Additional Resources

Review Security Roles

Security roles in Toast Payroll are similar to permissions in Toast Web. Security roles allow you to manage what pages and information your staff can view and what functions they have available to them, such as approving timesheets or running payroll. Security roles can also give your staff (typically managers and HR personnel) access to other employee information as needed.

Standard Security Roles

Note: Standard security roles cannot be edited. If you would like permissions that do not align with the standard issued roles, Toast Payroll Pro is required in order to create custom security roles.

Active Standard Security Roles

HR+: This gives users the highest level of access in the system. HR+ users can adjust security roles for all other users, including themselves
Manager: This user can only access employees who have been set up to directly report to them (Toast Payroll: Update Positions). Managers cannot run payroll.
Employee: This gives users access to their personal information only and allows them to update their own information as needed.
Payroll: Provides access to limited employee data and full access to run payroll. Note: As of January 2024, Toast Payroll will no longer support or update this security role.

Quick View of Active Standard Security Roles

✅ indicates that the security role can perform this action on all employees (unless noted). ❌ indicates they cannot.

Task	Employee	Manager	HR+
Hire new employees / Add team members (Toast Payroll: New Hire Employees (Employer Guide))	❌	✅ Can only hire into the Employee security role	✅
Update employee email addresses	✅ Self only	❌	✅ Only when the email address is unverified
View an employee's pay	✅ Self only	✅ Can only view employees within reporting structure*	✅
Assign and edit a job's pay (Toast Payroll: Make a Pay Change)	❌	✅ Can only view employees within reporting structure*	✅
View a employee's payment method (Toast Payroll: Set a Payment Method)	✅ Self only	✅ Can only view employees within reporting structure*	✅
Set or update their own direct deposit information with Plaid (Toast Payroll: Get Help With Direct Deposit Amounts)	✅ Self only	✅ Self only	✅ Self only
Set or update another user's direct deposit information manually (Toast Payroll: Get Help With Direct Deposit Amounts)	❌	❌	✅ Any profile but their own
Set a paper check payment method (Toast Payroll: Set a Payment Method)	✅ Self only	✅ Can only view employees within reporting structure*	✅
Add recurring earnings and deductions (Toast Payroll: Add or Edit Earnings & Deductions)	❌	❌	✅
Run payroll (Toast Payroll: Run Your Payroll)	❌	❌	✅
View and edit personal profiles (Toast Payroll: Update Employee Profile Information)	✅ Self only	✅ Can only view employees within reporting structure*	✅
Fill out Section 1 of Form I-9 (Toast Payroll: Complete Form I-9)	✅ Self only	❌	✅
Fill out Section 2 of Form I-9 (Toast Payroll: Complete Form I-9)	❌	✅ Can only view employees within reporting structure*	✅
Quick Calcs (Toast Payroll: Issue Manual Checks (Quick Calcs))	❌	❌	✅
View reports (Toast Payroll: Optimize the Report Library)	❌	✅ Limited set of reports available. Can only view employees within reporting structure*	✅
Approve timesheets (if applicable) (Toast Payroll: Manage Timesheets)	❌	✅ Can only see employees within reporting structure*	✅

*Can only view employees within reporting structure indicates the employee must be a direct report of the manager in order for the manager to access the Task above. To view who an employee reports to, navigate to their profile and scroll down to the Reports To tile. If you'd like to set who an employee reports to, read Toast Payroll: Update Positions.

Inactive Standard Payroll Security Roles

Applicant - This is for users who have applied for a job using the Toast Payroll Recruitment module (Toast Payroll: Get Started With Recruitment), but do not have an active employee record in the system until they are hired.
Termed - Employees receive a Termed security role as soon as a termination is processed. This gives them limited access to the My Profile tab and nothing else. In many cases, they will be able to view their Form W-2 from the Myself > Documents & Forms > Year End Documents page (Toast Payroll: Manage the Form W-2 Experience).

View or Adjust a User's Security Role

This is typically performed only by HR+ users. To manage admin access and security roles:

Navigate to an employee's profile > Position.
1. If an employee has multiple positions, the system will grant them security access based on the security role of their primary position only. The system does not look at the security role selected on secondary positions.
Select the yellow Edit button.
To make changes, first update the Reason field (e.g. Position or Administrative Update) and then apply your changes to the Security Role field.
Select Submit at the bottom of the page to apply your change.

Custom Security Roles

Note: Custom security roles are only available for Toast Payroll Pro accounts. Chat with us via the blue chat button in the lower-right corner of any Toast Payroll page if you'd like to upgrade to Toast Payroll Pro.

Custom security roles can be used for a number of reasons. In order to create a custom security role for your company, fill out this form and send it to us via the blue chat dot. The Customer Care team will work with you to correctly add and assign this new security role to your company database.

Security Role Access For Pay Changes

All HR+ and Manager-level security roles can see and edit pay for primary and secondary roles. Managers can only see and edit pay changes for employees who report to them (Toast Payroll: Update Positions).

Additional Resources

This content is for informational purposes and is not intended as legal, tax, HR, or any other professional advice. Please contact an attorney or other professional for advice.