Built to be asked about
Staffly handles national ID numbers, salary data and employment documents. Here is what has actually been done about that.
Where your data lives
Staffly runs on Google Cloud in the EU. Application logic runs in europe-west1 (Belgium), and data is processed within the EU/EEA.
- Data processed within the EU/EEA
- A data processing agreement can be signed
- Sub-processors disclosed on request
- Your data is yours - including if you leave
Who can see what
Access is governed at three levels: which modules the company has, which rights the user has, and what the individual role may see.
- Role-based access: sales, finance, recruitment, full access
- Read-only office users
- Two-factor by SMS can be required at login
- Portal users only ever see their own data
- Enforcement happens on the server too, not just in the browser
National ID and documents
National ID numbers are stored encrypted and only revealed when a user with the right actively asks. Documents are encrypted on upload.
- National ID encrypted in the database
- Sensitive files encrypted on upload
- Consent captured separately at registration
- Export and deletion of personal data can be handled
- Access to sensitive fields appears in the audit log
Audit log with export
Actions are logged with user, timestamp, action and what changed. The log can be filtered and exported when someone asks.
- Filter by date, user, action and object
- See what changed, and why
- Export to CSV
- History per employee, order and customer
The phone is an entry point too
The app locks with biometrics and an app lock, because a phone in a crew room is a different threat than a PC in an office.
- Face ID or fingerprint before the app opens
- App lock after inactivity
- Two-factor at login
- The same role-based access as in the browser
In short
EU/EØS
Data processed in the EU.
Databehandleraftale
Can be signed.
Kryptering
National ID and sensitive files.
To-faktor
SMS at login.
Rollestyring
Access per role and module.
Revisionslog
With filtering and export.
Questions from your IT or procurement?
Send them over and we will answer specifically - including the dull ones.