Security and trust
Built so you can trust it with your people’s data
Security here is described as it works today: how organisations are kept apart, how access is checked, how sign-in is protected and how changes are recorded.
Six principles
Your data stays yours
Every organisation is isolated from every other inside the database itself, not just in the application, so one customer can never read another’s records.
Access is checked on every request
Permissions are enforced on the server each time something is read or changed. Hiding a button is never treated as security.
Two-step sign-in for privileged roles
Anyone who can change pay, access or settings must verify with an authenticator app, and administrators can require it for everyone.
A trail nobody can quietly edit
Every change writes an audit record in the same transaction. Records are chained together so tampering can be detected.
Encrypted backups you control
Back up to your own Google Drive, encrypted with a passphrase only you hold, with restore checks built in.
Leaving never deletes your data
Downgrading or cancelling does not erase anything, and everyone keeps access to their own shifts, pay and payslips.
Security questions
Can one organisation see another organisation’s data?
No. Every organisation is isolated from every other inside the database itself, not just in the application, so a mistake in the application cannot expose another customer’s records.
Is hiding a button the same as restricting access?
No. Permissions are enforced on the server each time something is read or changed. A hidden button is a convenience, never the protection.
Who must use two-step sign-in?
Anyone who can change pay, access or settings must verify with an authenticator app, and administrators can require it for everyone.
Can the audit trail be edited?
Every change writes an audit record in the same transaction as the change, and records are chained together so tampering can be detected.
Can I take my own backup?
Yes. Back up to your own Google Drive, encrypted with a passphrase only you hold, with restore checks built in.
Policies and reporting
Our Terms of Service and Privacy Notice describe how we handle your data, and all policies are published together.
Security questions, or a vulnerability to report? Write to [email protected]. Our security.txt says how.
Ready to see it with your own organisation?
Create your organisation in a few minutes. No card needed to start.