Rosterfy

Rosterfy's SOC 2 report is available on request. Request access through SOC2C and we coordinate the company-side NDA and delivery.

Security isn't a single yes/no, but Rosterfy is SOC 2 Type II compliant and holds ISO 27001, SOC 2 Type II. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Rosterfy hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@rosterfy.com or via a /security page (Rosterfy lists a security contact).

Rosterfy lists 22 subprocessors on its trust center, including Amazon Web Services, Intercom, Lacework, Hubspot, Twilio. Buyers use this for fourth-party risk review.

Rosterfy hosts on AWS, GCP, and handles Customer personally identifiable information, Employee personally identifiable information, Credit card information, Personal health information. Data residency details are on its trust center.

Rosterfy's trust center is at https://trust.rosterfy.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Yes. Rosterfy supports single sign-on for customers through their Identity Providers. Rosterfy supports both SAML and OpenID SSO protocols to ensure our platform is compatible with your Identity Provider. We also support user provisioning, and role based access from your Identity Provider. SSO can be run either as an optional authentication method, or enforced for different user types. Most commonly our customers will use SSO for their enterprise users, and allow their workforce to use social logins, or usernames and passwords.

Rosterfy has shared tenancy application environments in the USA (Ohio), Canada (Montreal), UK (London), France (Paris) and Australia (Sydney). We also can support single tenancy environments in any AWS region at an additional license cost.

Rosterfy uses the industry standard AES-256 encryption algorithm to encrypt your data at rest. Backups are encrypted using Rosterfy customer keys to ensure it is not accessible to any other users of AWS infrastructure. Backups are immutable and stored at separate physical sites for maximum availability.

Rosterfy has an API that is available to all of our customers. API documentation can be found on our website. Our API uses Oauth tokens specific to a user of the application. Our API allows any of our customers to integrate the platform with their own tools or other systems. We also offer a webhook module so that you can setup callbacks to your own HTTPS platform when events occur in Rosterfy. Other interfaces to the Rosterfy application include - AWS SNS or Azure Service Bus Integrations for Rosterfy to stream messages to your service or subscription - SFTP of files to your own application server - 30+ integrations with existing vendors to integrate the Rosterfy application with other industry suppliers

Yes, Rosterfy has a robust security program supported by vulnerability and penetration testing. We have a number of platforms constantly monitoring Rosterfy infrastructure and services for vulnerabilities. We also have penetration tests conducted by CREST certified penetration testers. On request we can provide the latest VAPT testing reports.

You can report a potential security issue by sending an email to security@rosterfy.com. We have many controls in place monitoring and alerting to potential security threats, however if you have found something we should be aware of please let us know.

Our strict internal procedure prevents any employee or administrator from gaining access to user data. Limited exceptions can be made for customer support where data does not cross borders. All our employees that do have limited access to customer data are background checked before beginning employment. Auditing and logging of all employee actions within our platforms is maintained for transparency.

Customers can define their own roles within their account to be assigned to users. Roles can have both functional limits (ie can read user, cannot update user) as well as record based limits (ie can only see people from Victoria) to support customer business requirements