How Roster Flow processes workforce data

Who is responsible for what

A business that uses Roster Flow decides which of its people are added, what is recorded about their working time, and whether clock in photos and location checks are switched on. Roster Flow holds and processes that information to provide the service to that business, and does not use it for anything else.

What is held

• People. Name, email address, optional mobile number, job title, venues, role, employment type and start date.
• Working time. Shifts, clock ins and outs, breaks, corrections and approvals, with who changed what, when and the reason given.
• Clock in photos and distance, only where the business has switched them on.
• Pay rates and loadings, typed in or imported from Xero or MYOB, used to estimate a roster’s cost.
• Work rights, where a person records them: residency or visa type, expiry and any hours limit.
• Leave and availability, as staff enter them.

How it is protected

• Passwords are stored as scrypt hashes, never as the password itself. Repeated failed sign-ins are slowed down.
• A sign-in lasts up to thirty days. Two-step sign-in with an authenticator app can be turned on for any account, and other devices can be signed out in one action.
• Payroll connection tokens and the credentials the service uses are stored encrypted.
• Three roles decide access: owners, managers and staff. Managers can be limited to their own venues.

How long it stays

• Clock in photos are deleted after the number of days the business sets. A business can choose to keep them.
• Time records, approvals and the change history stay for as long as the account exists, because they are pay records the business may have to produce.
• Invitation links expire after fourteen days and password reset links after sixty minutes.

Taking it, and deleting it

Every report exports to CSV whenever the business wants it. When an account is closed, the business can ask for it to be removed, and removing an account deletes its rosters, timesheets and records. Take an export first: removal cannot be undone.

Asking about it

Questions and requests go to hello@rosterflow.com.au. Who else handles information, and why, is set out in the privacy policy.