Rostrix Security

Our security position

We focus on practical controls: encrypted connections, authenticated sessions, organisation isolation, role-based permissions, private document access pathways, and operational monitoring.

We do not claim military-grade, bank-grade, unhackable or 100% secure status. We also do not claim SOC 2, ISO 27001, PCI DSS, GDPR certification, HIPAA or similar certifications unless independently achieved and published.

Secure connections

Rostrix is served over HTTPS so data in transit between supported browsers and the application is encrypted.

Authentication

User authentication is handled with NextAuth. Sessions use secure JWT cookies. Passwords, where used, are stored as bcrypt hashes rather than plaintext.

Users can sign out to end their session. Customers should still apply good credential hygiene and promptly revoke access for departing staff.

Role-based access

Rostrix supports organisation roles and configurable permissions. Sensitive actions such as viewing pay information, managing documents or changing organisation settings are intended to be limited to authorised roles.

Authorisation is enforced in server-side application logic, not only by hiding UI controls.

Organisation-level data isolation

Customer workspaces are separated by organisation identifiers. Users belonging to one organisation should not be able to access another organisation’s employees, documents, rosters or time records by changing IDs in URLs or API requests.

Employee document protection

Employee and operational documents uploaded into Rostrix are stored in Cloudflare R2 object storage.

Document access and download pathways are designed to require an authenticated user who belongs to the relevant organisation and has appropriate permission. Knowing a URL alone is not treated as sufficient authorisation for private documents.

Your business data remains your business data. Employee documents are stored privately and are available only to authorised users within your organisation.

Cloud storage

File objects are stored with Cloudflare R2. Application credentials for storage remain server-side and are not exposed to the browser.

Database security

Application data is stored in PostgreSQL. Database credentials are kept in server environment configuration and are not shipped to clients.

The database runs on the same server as the Rostrix application.

Access control

Access to production systems is limited to operational needs. Within the product, membership and role checks gate sensitive resources including pay rates, GPS/time-clock location fields, documents and organisation settings.

Application and error monitoring

Rostrix includes built-in application analytics and error/operational monitoring to help detect issues. Marketing click names stay in the browser and are not sent to a vendor. When a Meta Pixel ID is configured, public marketing, sign-in and registration pages load Meta’s pixel for advertising measurement. That pixel does not receive the person’s name, email address, or account id. We aim to avoid placing unnecessary sensitive personal information into analytics events.

AI features

Rostrix AI calls OpenAI’s Chat Completions API. The only model is gpt-6-luna. A prompt can include the user’s question plus the operational records retrieved for that question, including roster, staff, leave, time clock, tasks and other operations records. Labour cost and pay rates are included only when that user’s role is allowed to see them. If the role is not allowed, Rostrix answers with a permission refusal and does not send those figures to the model. A voice report uses the caption from the browser. The recording is not sent to a separate transcription model.

A staff member asking about their own day is given their own schedule context. That prompt tells the model to refuse questions about other employees, labour cost and venue-wide figures.

Roster AI proposals are applied as unpublished shifts. Publishing those shifts stays a separate manual step. Automatic sick cover is off unless a business turns it on. When it is on, that setting can assign cover and publish it without another approval.

Ask Rostrix stores the question, the answer and the source snippets in the Rostrix database, with the provider and model name. The code does not keep a separate log of the full prompt. Stored conversations have no deletion period in the product.

OpenAI’s platform documentation says API inputs and outputs are not used to train models unless the customer opts in. Abuse-monitoring logs for chat completions are kept for up to 30 days, and longer where the law requires it. Rostrix has not turned on zero data retention.

Security incident response

If a security issue is identified, Rostrix investigates, contains and remediates as appropriate, and notifies affected parties where required by law or contract.

To report a suspected security issue, email security@rostrix.app with the subject “Rostrix Security Issue”. Please include enough detail for responsible investigation and avoid publicly disclosing exploit details before we can respond.

Data deletion and export

Customers can request organisation data export and organisation deletion through Settings → Legal & Privacy or by contacting support. Some requests may be handled through a controlled support workflow to avoid unsafe automated destruction.

Third-party service providers

Providers that receive data so Rostrix can run are Hostinger (hosting), Cloudflare R2 (file storage), Resend (email), Stripe (payments) and OpenAI (Rostrix AI). Meta (Facebook and Instagram advertising measurement) receives a page view and a registration event from public pages when a Meta Pixel ID is configured. Square (point of sale) and Xero (payroll) receive data only after that business connects them. See Subprocessors & Service Providers for purpose, region and retention.

Location / GPS

Location is captured at clock-in and clock-out when enabled. Rostrix does not continuously track employee location.

Stored location associated with time records is treated as sensitive operational information and is restricted by organisation and permission checks.