Security
Your data, scoped to your company.
RotaTree is multi-tenant. Every row belongs to one company, and the database enforces that. Here is what is in place, and what we do not claim.
-
Row-level security
Every table is company-scoped and protected by PostgreSQL row-level security. A query cannot return another company’s rows.
-
Role-based visibility
Three roles: admin, manager, employee. Managers only see their locations. Employees never see colleagues’ pay.
-
Server-side functions
Sensitive actions, such as approving attendance or signing QR codes, run in server-side functions, not in the browser.
-
API keys stored hashed
An API key is shown once. Only its hash is stored. Keys are tied to one company and can be revoked.
-
Attendance checks
QR codes rotate every 20 seconds and are signed server-side. Scans are checked against the workplace network. This reduces remote clock-ins; it does not prove physical presence.
-
HTTPS everywhere
All traffic uses HTTPS. The database runs on Supabase (PostgreSQL) and the application on a VPS.
What we do not claim
RotaTree does not hold SOC 2 or ISO 27001 certification, and this page is not a compliance statement. We do not publish a hosting region here; ask and we will confirm it in writing. If your procurement process needs specific answers, email hello@rotatree.com and we will respond in writing.
FAQs
Can one company see another company’s data?
No. Row-level security in the database scopes every row to a company.
Can employees see what colleagues are paid?
No.
Can managers see every location?
Only the locations they are assigned to.
How are API keys stored?
Hashed. The full key is shown once, when it is created.
Where is the data hosted?
On Supabase (PostgreSQL) and a VPS. Ask us for the region and we will confirm it in writing.
How do we get a demo?
Tell us how big the team is. We will show you RotaTree set up for a team like yours.
- Weekly rota
- Monthly rota
- Open shifts
- Copy week
- Draft to publish
- Labour cost per day
- Leave ledger
- Sickness and TOIL
- Availability patterns
- 20-second QR clock-in
- Monthly attendance sheet
- Payroll lock
- Scheduled vs actual
- CSV export
- API
- Signed webhooks
- Multi-location
- Pay rates
- Weekly-hour limits