How Roster Flow protects workforce data

Rosters hold people's names, hours and pay rates. This page sets out who can see what, where it is processed, how changes are recorded, how payroll connections are authorised and what happens when a business leaves. Everything on it was checked against the product.

Three roles, and nothing in between

Owner

Everything a manager can do, plus billing, the payroll connection, and the weekend and public holiday loadings.

Manager

Builds and publishes rosters, approves hours, sets pay rates and sees the cost estimates.

Staff

Sees their own shifts, clocks in and out, sets availability and asks for leave, swaps or a correction. No rates, no other people's pay.

A record of every changeShifts, clock times, corrections and approvals are stored with who made the change and when, in an audit trail owners and managers can read in Settings.

A second step, if you want oneTwo-step sign-in can be turned on for any account: a code from an authenticator app as well as the password, with recovery codes shown once when it is set up. Account settings also lists every device the account is signed in on, and signs the others out in one press.

Your hours, in a file you keepEvery table on the reports screen exports to CSV whenever you want it, for your payroll or your records. None of them carry pay figures.

Payroll connections you controlXero and MYOB are connected by the owner through their own sign in, and disconnected in the same place. Only approved hours are sent: draft timesheets in Xero, timesheets in MYOB payroll.

People who leaveDeactivating somebody removes their access immediately and stops them counting towards your plan, while the hours they worked stay on the record.

Passwords that are never storedA password is kept only as a scrypt hash, and repeated failed sign-ins are slowed down. A sign-in lasts up to thirty days, and every signed in device is listed in account settings.

Managers kept to their venuesAn owner can limit managers to the venues they are assigned to. They then see and change only those venues’ rosters, timesheets and people. Owners always see the whole business.

Clock in photos that are not kept foreverPhotos and the location check are switched on by the business, not by default. Photos are deleted after the number of days the business sets.

When a business leavesExport the reports as CSV first. Removing an account deletes its rosters, timesheets and records, and it cannot be undone, so ask for it only when you are sure.

What is not claimed hereRoster Flow does not currently hold an ISO 27001 or SOC 2 certification, and this page does not suggest otherwise.

Questions about data and access

Who can see pay rates in Roster Flow?

Owners and managers. Staff see their own shifts, hours and requests, with no rates and no other people’s pay.

Is Roster Flow ISO 27001 or SOC 2 certified?

No. Roster Flow does not currently hold an ISO 27001 or SOC 2 certification, and nothing on this site suggests otherwise.

How are Roster Flow passwords protected?

A password is kept only as a scrypt hash, repeated failed sign ins are slowed down, and two step sign in with an authenticator app can be turned on for any account.

What happens to our records if the account is removed?

Removing an account deletes its rosters, timesheets and records, and it cannot be undone. Export the reports as CSV first, and ask for removal only when you are sure.

The written detail

Privacy policyWhat is collected, who sees it and how long it is kept.Terms of serviceThe agreement, what it costs and how either side ends it.Data processingWhat is handled on a business’s behalf, and by whom.AccessibilityWhat the app aims for, and where it falls short.Release notesWhat changed in the product, and when.About Roster FlowWho builds it, and what it is for.

Something not covered here?

Send the question through and we will answer it in writing.