Security

This page describes measures that are in Shiftbrook today. It is not a certification, and we do not claim an ISO or SOC report. Questions go to [email protected].

Sign-in

• Passwords are stored as a scrypt hash with a random salt. The password itself is not stored.
• A password must be at least 10 characters.
• The sign-in cookie is HttpOnly and SameSite=Lax, and it is marked Secure when the site is served over HTTPS.
• A person can turn on an authenticator app, with recovery codes. An owner can require that for admins.
• A magic link and a password reset link expire, and each can be used once.

Access inside an organisation

• Staff see their own shifts, leave and timesheets. Draft shifts stay hidden until a manager publishes them.
• A sickness reason is shown to the person, their manager, an owner or HR. Colleagues are not given the reason.
• The phone’s location is read only when someone clocks in or clocks out, to check the site pin. Shiftbrook does not follow the phone between punches.
• Owners, admins and HR can open an audit log of approvals, edits, role changes, settings and integrations.

Connections and files

• When the integration storage key is configured, connection tokens are encrypted with AES-256-GCM before they are stored. If that key is not set, the connection is not saved.
• A new API key and a new webhook secret are shown once, in an HttpOnly cookie, and then cleared.
• Profile photos are stored in the application database and are served only to someone in the same organisation.

Hosting

The public site is served over HTTPS. We have not published a penetration-test report, and this page should not be read as one.

How long records are kept, and who to contact about your data, is in the privacy notice.