Rosterly
ENNL
Sign in Create workspace

Security and your data

Your rota, your staff, your wages: where the data lives

Who can see a wage, what sits on a person's record, where the file lives, how backups are made, and what leaving looks like. Where something is missing, we say so.

Who can see a wage, and who cannot

Four kinds of account exist here. Only two can reach a money figure.

  • Owner

    Everything: rates, the week's cost, the audit trail, invoices and the delete-workspace button. Only the owner invites planners or changes billing.

  • Planner

    The people with an employee role: their rates, hours, availability and the week's cost. Not billing, and never the owner's or another planner's record.

  • Employee

    Their own rota, hours, availability, leave, swaps and contract, plus published shifts of colleagues nearby. Never a wage figure for anyone. Colleagues can be shown as initials.

  • Applicant

    Applies to an open shift, and sees nothing else.

  • Wages are not on the Team screen, which lists name, email, status and next shift. Rates sit on the cost view and the wage exports.
  • Every row carries its workspace: one company can never reach another's rows.

What is stored per person

Only what a rota and a working-hours check need. Only a name and an email address are required.

  • Name, email, role, department, location, status. Contract type and the contract hours you agreed.
  • Date of birth, only if you enter it, for the Dutch rules on staff under 18. A phone number, if you enter one.
  • An hourly wage, if you enter one. Without rates a plan still builds a rota, it just cannot show the cost.
  • Availability, shifts, swaps, leave, and the clock-in and clock-out moments the person records themselves.
  • The password, stored only as a hash; a forgotten one is reset through a one-time link.

We do not ask for health, ethnicity, religion or union data. No time-clock hardware, no tracking.

Where the data lives, and who else can touch it

  • One database file on one rented Linux server from a European provider, in a European datacenter. No second database, no separate storage, no distributed setup.
  • Served over HTTPS with a self-renewing certificate and three hardening headers: no content-type guessing, no framing the app, referrer to this origin only. The app runs as its own account, not the administrator.
  • Honest limit: the file is not encrypted at rest. Protection is the access control of the machine it sits on.
  • Two other parties can touch the data, and no one else. The hosting provider, whose datacenter holds the server, and a European email service, which sends the notification mail. Invoices are issued by us and paid by bank transfer today; when card payments are switched on, a Dutch payment provider will process them and would hold card details we never store. Off-site backups are not switched on yet — when they are, they will be encrypted before they leave the server.
  • No analytics, no advertising trackers, no third-party widget, no data sold.

Backups

A backup you cannot open is not a backup, so the job refuses to pass silently.

  • Every night at 03:00 a point-in-time copy goes to a separate directory, using the database engine's own backup command, safe while the app runs. The copy is then opened and checked; a missing or unreadable one fails the job visibly.
  • Fourteen daily copies are kept, older ones compressed and removed.
  • Off-site copies are available but optional. Where they are not configured the script says so plainly: the only copy then lives beside the data it protects.
  • Deleted data leaves the live database at once, and the backups as they rotate out within fourteen days.

Getting your data out, in one click

In the product, not behind a support ticket, when you arrive and when you leave.

  • People and wages: a CSV of everyone, including the hourly rate column. Availability: a CSV of what each person can work.
  • Hours and cost: a payroll export for any period, with hours, surcharges and cost per shift, ready for a payroll bureau.
  • The whole workspace in one file, for the owner: people, settings, rules, holidays and the last two hundred admin actions.
  • Exports keep working when a workspace is locked over an unpaid invoice. Your data is yours.

What an import looks like is on switching your rota to Rosterly; what we process and why is in the privacy policy and the terms of service.

Deleting a person, or the whole workspace

When one person asks to be removed

  • Future shifts go back to open, open swaps are cancelled, undecided leave is declined, availability deleted, sessions killed, the account switched off.
  • The email address is replaced by a non-deliverable placeholder, so it can never be written to again.
  • Kept: the name, wage and shifts already worked, because your rota history and hours records are built from them.
  • Complete erasure: mail support@roosterly.pro and we remove the remaining record. You need not be a paying customer.

When the whole company leaves

  • The owner deletes the workspace in one operation that removes it and every row belonging to it, people included. If part cannot complete, it is rolled back and the product says plainly that nothing was removed.
  • That button needs an unlocked workspace. If yours is locked and you want the data gone, mail us.

What we are not claiming

The part most vendors leave out.

  • No certification. No ISO 27001, no SOC 2, and no badge for either: there is no security logo here because there is nothing behind one.
  • No penetration-test report to send you, and no implication that one exists.
  • One server, one database, no failover. If the hardware dies, the answer is a restore from backup, not an instant switch.
  • Rosterly is planning software, not a payroll system, and not legal or tax advice. Cost and surcharge figures are estimates from the rates you enter and do not determine anyone's pay.

Start with your own people and your own numbers

Click below and you get a workspace to fill in: free for up to three active employees, no card, with every export above available on day one. Put three real names in and see where the data sits.

Create your workspace See what it costs

Questions before you sign up, including the ones we cannot answer with a certificate: support@roosterly.pro.