Security and privacy
You will trust us with your staff's licences, right-to-work records and shift details. Here is exactly how we protect them, and where we are still working. We would rather be plain than reassuring.
Every record belongs to one company, and the database itself refuses to show or accept a record from another. This is enforced by row-level security rules in the database, not only by the screens in front of it, so a mistake in the app cannot expose another company's data.
More than a hundred automated checks run against a two-company set-up. They try to read, write and cross-link data between companies, between officers, and from signed-out visitors. They are run before changes go live. They test our own rules; they are not an independent audit.
Documents are stored in a private area, in a folder for the company and the person. Links to view a file expire after minutes. Allowed types are JPEG, PNG, WebP and PDF, up to 10 MB.
Approvals, rejections, shift changes and people changes are written to an audit trail with who and when. Submitted forms and check-ins cannot be edited or deleted. Check-in times are set by the server.
Who can see what
| Person | Sees | Can change |
|---|---|---|
| Officer | Their own record, documents, shifts, check-ins and forms. Site names on their shifts. | Submits their own documents and forms. Checks in to their own shift. Cannot approve anything. |
| Manager | Everything in their own company: people, clients, sites, shifts, documents, forms. | Reviews evidence, records checks, builds the rota, sets check-in keys, resets officer sign-ins, invites officers. |
| Control-room operator | Shifts, check-ins, the people and phone numbers of their own company. No licences, documents, forms or settings. | Logs calls. Records a check-in for an officer after reaching them by phone, marked as made by the control room. |
| Owner | As a manager. | As a manager, and can invite managers. |
| Another company | Nothing. | Nothing. |
| Signed-out visitor | Nothing. | Nothing. |
Sign-in and check-in keys
Officers can be given a generated username and password. They must choose their own password at first sign-in. The four-digit check-in key is stored scrambled, cannot be read back by anyone, and locks for 15 minutes after five wrong tries. The powerful step that creates a sign-in runs inside our database provider, and its master key never appears in the app, in our code, or in a browser.
A four-digit key is short by design, so the lockout is its protection. It has not yet had independent review.
Formal documents, including a privacy notice and a data processing agreement, are being prepared and will be shared with you before any pilot begins. Data is currently held in the EU.
