Security & Data Protection Overview

Current controls

• Platform-managed encrypted network transport and managed application/database infrastructure.
• Workspace-scoped records and authenticated dashboard context where platform identity is available.
• Server-side validation, bounded inputs, and rate limits for public submissions.
• Audit events for material agent, approval, policy, and workspace actions.
• Human configuration gate, draft-only defaults, confidence thresholds, task caps, approval queues, and emergency pause controls.
• Least-function defaults: integrations remain disconnected until separately authorized.

Operational practices

We apply access limitation, change review, dependency maintenance, logging, backup/recovery capabilities supplied by managed infrastructure, and incident triage appropriate to the service’s size and risk. Controls evolve as StaffRooster matures.

Customer responsibilities

Use strong platform credentials, restrict administrators, review access, minimize submitted data, configure agent boundaries, monitor logs, revoke stale integrations, and report anomalies promptly. Do not treat StaffRooster as a system of record for excluded sensitive data.

Incident reporting

Report a suspected vulnerability or security incident via Contact with “Support,” avoiding live credentials or unnecessary personal data. We request coordinated disclosure and will investigate credible reports.

Assurance boundary

We do not claim SOC 2, ISO 27001, PCI DSS, HIPAA, FedRAMP, or another certification or authorization unless confirmed in a signed agreement. This overview is not an audit report, penetration test, warranty, or promise that all attacks can be prevented.