Secure HR Data Exchange between SAP SuccessFactors and Payroll Using AI-Optimized Encryption, Masking, and Data Minimization Controls
DOI:
https://doi.org/10.15662/IJRAI.2026.0901014Keywords:
SAP SuccessFactors integration, payroll data security, HR data exchange, enterprise encryption architecture, data masking controls, data minimization strategy, AI assisted security optimization, policy driven access control, GDPR compliant HR systems, cryptographic key management, sensitive data governance, enterprise integration risk managementAbstract
Secure exchange of human resource data between cloud based human capital management platforms and downstream payroll systems has become a critical enterprise concern as organizations increasingly rely on distributed integration architectures. This study examines the confidentiality, integrity, and exposure risks inherent in data flows between SAP SuccessFactors and payroll platforms, with particular attention to personally identifiable and financial information subject to stringent regulatory obligations. The paper argues that traditional perimeter based security and static encryption alone are insufficient to address overexposure, misuse, and operational leakage of sensitive HR attributes during routine payroll processing. To address this gap, the study proposes a unified control framework that combines strong cryptographic protection, policy driven masking, and strict data minimization, augmented by AI optimized decision logic appropriate to the technological landscape of 2019. The framework leverages statistical risk scoring, rule augmented learning, and anomaly detection techniques to dynamically select encryption strength, masking profiles, and attribute level payload composition based on data sensitivity, purpose limitation, and operational context. A reference architecture is presented to demonstrate how these controls can be embedded across extraction, transformation, transmission, and ingestion layers without disrupting payroll accuracy or timeliness. Evaluation considerations focus on measurable reductions in data exposure, improved audit evidence generation, and enhanced governance transparency rather than speculative automation claims. The findings suggest that AI optimized security orchestration can materially improve trust and compliance in HR data exchanges while remaining compatible with established enterprise integration patterns. This work contributes a practical and extensible foundation for secure HR system interoperability and offers a defensible baseline for future research on adaptive data protection in enterprise information systems.
References
[1] Sandhu, R. S., Coyne, E. J., Feinstein, H. L., & Youman, C. E. (1996). Role-based access control models. Computer, 29(2), 38–47. https://doi.org/10.1109/2.485845
[2] Domingo-Ferrer, J., & Mateo-Sanz, J. M. (2002). Practical data-oriented microaggregation for statistical disclosure control. IEEE Transactions on Knowledge and Data Engineering, 14(1), 189–201. https://doi.org/10.1109/69.979982
[3] Dwork, C. (2006). Calibrating noise to sensitivity in private data analysis. In S. Halevi & T. Rabin (Eds.), Theory of Cryptography Conference (TCC 2006), Lecture Notes in Computer Science (Vol. 3876, pp. 265–284). Springer. https://doi.org/10.1007/11681878_14
[4] Bethencourt, J., Sahai, A., & Waters, B. (2007). Ciphertext-policy attribute-based encryption. In 2007 IEEE Symposium on Security and Privacy (SP 2007) (pp. 321–334). IEEE. https://doi.org/10.1109/SP.2007.11
[5] Machanavajjhala, A., Kifer, D., Gehrke, J., & Venkitasubramaniam, M. (2007). l-diversity: Privacy beyond k-anonymity. ACM Transactions on Knowledge Discovery from Data, 1(1), Article 3. https://doi.org/10.1145/1217299.1217302
[6] Li, N., Li, T., & Venkatasubramanian, S. (2007). t-closeness: Privacy beyond k-anonymity and l-diversity. In 2007 IEEE 23rd International Conference on Data Engineering (ICDE 2007) (pp. 106–115). IEEE. https://doi.org/10.1109/ICDE.2007.367856
[7] Gentry, C. (2009). Fully homomorphic encryption using ideal lattices. In Proceedings of the 41st Annual ACM Symposium on Theory of Computing (STOC 2009) (pp. 169–178). ACM. https://doi.org/10.1145/1536414.1536440
[8] Bellare, M., Ristenpart, T., Rogaway, P., & Stegers, T. (2009). Format-preserving encryption. In M. J. Jacobson Jr., V. Rijmen, & R. Safavi-Naini (Eds.), Selected Areas in Cryptography (SAC 2009), Lecture Notes in Computer Science (Vol. 5867, pp. 295–312). Springer. https://doi.org/10.1007/978-3-642-05445-7_19
[9] Matatov, N., Rokach, L., & Maimon, O. (2010). Privacy-preserving data mining: A feature set partitioning approach. Information Sciences, 180(14), 2696–2720. https://doi.org/10.1016/j.ins.2010.03.011
[10] McQuay, T., & Cavoukian, A. (2010). A pragmatic approach to privacy risk optimization: Privacy by design for business practices. Identity in the Information Society, 3(2), 379–399. https://doi.org/10.1007/s12394-010-0067-6
[11] Asghar, M. R., Ion, M., Russello, G., & Crispo, B. (2011). Securing data provenance in the cloud. In S. N. Foley, D. Gollmann, & E. Snekkenes (Eds.), Information Security and Privacy (IFIP SEC 2011), Lecture Notes in Computer Science (Vol. 6892, pp. 163–177). Springer. https://doi.org/10.1007/978-3-642-27585-2_12
[12] McDaniel, P. (2011). Data provenance and security. IEEE Security & Privacy, 9(2), 83–85. https://doi.org/10.1109/MSP.2011.27
[13] Stapleton, J. (2011). Tokenization: The new encryption. Information Security Journal: A Global Perspective, 20(1), 12–19. https://doi.org/10.1080/19393555.2011.560923
[14] Sheikh, R., Kumar, B., Mishra, D. K., & Jhanjhi, N. Z. (2011). Secure multiparty computation: From millionaires problem to anonymizer. Information Security Journal: A Global Perspective, 20(4), 181–186. https://doi.org/10.1080/19393555.2010.544701
[15] Sánchez, D., Martínez, S., & Domingo-Ferrer, J. (2012). Detecting sensitive information from textual documents. In J. Domingo-Ferrer & I. Tinnirello (Eds.), Privacy in Statistical Databases (PSD 2012), Lecture Notes in Computer Science (Vol. 7556, pp. 173–184). Springer. https://doi.org/10.1007/978-3-642-34620-0_17
[16] Martínez, S., Sánchez, D., Valls, A., & Batet, M. (2012). Privacy protection of textual attributes through a semantic-based masking method. Information Fusion, 13(4), 304–314. https://doi.org/10.1016/j.inffus.2011.03.004
[17] Chen, T. S., Wu, C. S., Chen, Y. F., & Chang, J. H. (2013). Reversible privacy-preserving data mining. The Journal of Supercomputing, 66(3), 1271–1286. https://doi.org/10.1007/s11227-013-0926-7
[18] Hoepman, J. H. (2014). Privacy design strategies. In S. Fischer-Hübner, E. Wright, L. Martucci, & S. Zouaghi (Eds.), Privacy Technologies and Policy (IFIP APF 2014), Lecture Notes in Computer Science (Vol. 8450, pp. 446–459). Springer. https://doi.org/10.1007/978-3-642-55415-5_38
[19] Memon, M., Sadiq, M., & Menzel, M. (2014). Security modeling for service-oriented systems using security patterns. Software & Systems Modeling, 13(2), 521–541. https://doi.org/10.1007/s10270-012-0268-6
[20] Ranshous, S., Shen, S., Koutra, D., Harenberg, S., Faloutsos, C., & Samatova, N. F. (2015). Anomaly detection in dynamic networks: A survey. Wiley Interdisciplinary Reviews: Computational Statistics, 7(3), 223–247. https://doi.org/10.1002/wics.1347
[21] Ahmed, M., Mahmood, A. N., & Hu, J. (2016). A survey of network anomaly detection techniques. Journal of Network and Computer Applications, 60, 19–31. https://doi.org/10.1016/j.jnca.2015.11.016
[22] Amir-Mohammadian, S., Chong, S., & Skalka, C. (2016). Correct audit logging: Theory and practice. In F. Piessens & L. Viganò (Eds.), Principles of Security and Trust (POST 2016), Lecture Notes in Computer Science (Vol. 9635, pp. 139–162). Springer. https://doi.org/10.1007/978-3-662-49635-0_8
[23] Chassang, G. (2017). The impact of the EU general data protection regulation on scientific research. Ecancermedicalscience, 11, 709. https://doi.org/10.3332/ecancer.2017.709
[24] Anderson, R., & Moore, T. (2006). The economics of information security. Science, 314(5799), 610–613. https://doi.org/10.1126/science.1130992
[25] Subashini, S., & Kavitha, V. (2011). A survey on security issues in service delivery models of cloud computing. Journal of Network and Computer Applications, 34(1), 1–11. https://doi.org/10.1016/j.jnca.2010.07.006
[26] Schneier, B., & Kelsey, J. (1999). Secure audit logs to support computer forensics. ACM Transactions on Information and System Security, 2(2), 159–176. https://doi.org/10.1145/317087.317089
[27] Spiekermann, S. (2012). The challenges of privacy by design. Communications of the ACM, 55(7), 38–40. https://doi.org/10.1145/2209249.2209263
[28] Antignac, T., & Le Métayer, D. (2014). Privacy by design: From technologies to architectures. In B. Preneel & D. Ikonomou (Eds.), Privacy Technologies and Policy (APF 2014) (Lecture Notes in Computer Science, Vol. 8450, pp. 1–17). Springer. https://doi.org/10.1007/978-3-319-06749-0_1
