Security at Rosterly
Rosterly holds sensitive workforce data — employee records, timesheets, and payroll information. Protecting that data is core to how we build the platform. This page describes the security measures we have in place today.
TLS/HTTPS for all traffic and AES-256 encryption for stored data and files.
Every database query is scoped to your organisation at the application layer.
bcrypt password hashing, secure sessions, CSRF protection, and role-based access.
1. Encryption
All data transmitted between your browser and Rosterly is encrypted using TLS (HTTPS), with HTTP Strict Transport Security enforced so browsers only ever connect over a secure channel. Data stored in our databases and file storage is encrypted at rest using AES-256.
2. Authentication & Access Control
- Passwords are hashed with bcrypt — we never store plaintext passwords.
- Sessions are validated server-side on every request, with CSRF protection and secure, host-scoped cookies.
- A four-tier role-based access model (Superadmin, Admin, Manager, Employee) ensures each user only accesses functions and data appropriate to their role.
- Administrators can require a password change on first login for provisioned accounts.
3. Multi-Tenant Data Isolation
Each organisation’s data is logically isolated. Every database query is scoped to the authenticated user’s organisation at the application level, so one client cannot access another’s data — even if requests are manipulated.
4. Secure File Storage
Employee documents (identity documents, contracts, and similar) are stored in encrypted cloud storage. Files are never publicly accessible — each upload and download is authenticated and served through time-limited signed URLs.
5. Application & Network Hardening
- Strict security response headers, including a Content Security Policy, clickjacking protection (frame-ancestors / X-Frame-Options), MIME-sniffing protection, and a restrictive permissions policy.
- Cross-origin isolation headers to reduce the risk of cross-site data leaks.
- Hosted on enterprise-grade managed cloud infrastructure with DDoS protection and continuous uptime monitoring.
6. Database Security
Our database enforces connection limits, idle-session timeouts, and statement timeouts to prevent abuse. Connections are encrypted, and access is restricted to the application layer only — there is no direct external database access. Automated backups are performed on the managed platform.
7. Privacy & Compliance
We handle personal information in accordance with the New Zealand Privacy Act 2020, including the notifiable-breach requirements. For full detail on what we collect and how it is used, see our Privacy Policy and Terms of Service.
8. Responsible Disclosure
We welcome reports from security researchers. If you believe you have found a vulnerability, please email us so we can investigate and respond. Please give us a reasonable opportunity to remediate before any public disclosure, and avoid accessing or modifying data that is not your own.