Context
Lohnexperten Rhein processes salary corrections across Germany. A correction campaign means collecting personal and payroll details from thousands of employees, verifying them, and paying out, under GDPR, at speed.
The problem
The process ran on email and offline spreadsheets. That created three problems at once: a bottleneck when volume spiked, a data protection exposure that nobody was comfortable with, and inconsistent records that made reconciliation slow.
The hard constraint was the users. These were employees receiving a letter in the post, not customers of a software product. Anything requiring an account, a password, or a support call would fail at scale.
What I decided
I removed the account entirely. Each person receives a physical letter with a unique code and QR link. Scanning it opens the portal, and identity is confirmed with the code plus date of birth, capped at three attempts. No password to create, forget, or reset, and no user database to breach in the usual way.
That choice drove everything else. Sessions log out automatically after submission so nothing lingers on a shared or borrowed device. Data is encrypted in transit and stored against unique identifiers rather than names. The three-attempt limit does the work a password policy normally would.
For administrators I built the opposite: full visibility. A dashboard of submissions and login rates, analytics on daily activity and failed attempts, and one-click CSV export into their accounting and ERP tooling.
Removing the account removed the recovery path with it. There is no "forgot my password" when there is no password: a lost letter or a third failed attempt means a reissue through the client's admin team, which is slower and more manual than a self-service reset would have been.
That was a deliberate trade. Self-service recovery would have meant holding enough identifying data to verify someone remotely, on a system handling payroll records under GDPR, for a population using it exactly once. The support cost sat with the admin team, who were equipped for it. The alternative would have sat with everyone.
Across the campaign that came to around 5,000 reissues, each one a manual job for the admin team. It is the cost of the decision stated plainly, and the client took it knowingly rather than discovering it later.
What shipped
A QR-authenticated submission portal with encrypted data flow, automatic session logout, and a tailored form per campaign. An admin interface with live metrics, analytics, role-based access, and CSV export.
The result
Over 10 million euros in payroll adjustments managed through the platform. Manual data entry down by 90%, and submissions validated in hours rather than days. The login success rate exceeded 98%, which for a population accessing a portal from a letter is the number I actually cared about.