Security and privacy at Backfyl

The answers hospitals, aged care providers and retailers ask for before they choose a rostering platform: where the data is kept, who can see it, how people sign in, and what happens to it when they leave. Everything here is also in our privacy policy, which is the full statement.

Where your data is hosted

In an encrypted database, in the Netherlands, or in Sydney if you need it. Each team’s app and database run on Railway, in its EU West region in the Netherlands. An Enterprise agreement can include hosting in Australia instead: the team’s app, its database and the database’s backups then run on Microsoft Azure in Sydney (Australia East). Either way the database is stored encrypted (AES-256). Account, sign-in and billing records are kept by the backfyl.com website, in the Netherlands.
A separate database for every team. One team’s data is never mixed with another’s in shared tables, and one team can never see another team’s data.
Not on the public internet. A team’s database can be reached only by that team’s own app, not from outside.
Limited access. Only the Backfyl team can reach the hosting and the databases, and only to give support or fix a problem.

Who in a team can see and do what

Roles and permissions. Each person has one of three roles, which the team names for itself (for example admin, manager and staff). Admins always have every permission and choose which of the others the second and third roles have: inviting and approving people, managing roles and tags, managing any request, managing timesheets and posting notices. Only an admin can change permissions.
Managers see the parts they run. In a team with several venues, a manager runs the venues or departments they are given.
Replies are private. A request for cover goes to the people its sender picks. A reply is seen only by the sender and the team’s managers. Nobody sees who else was asked or what anyone else answered.
Timesheets are seen by the person they belong to, the team’s admins and anyone an admin allows to manage timesheets, including where each tap was made when location recording is on.
Availability, leave and certificates are seen by the person and the managers who run the roster, not by the rest of the team.
A record of changes. Changes by managers and admins to the roster, allocations, leave, swaps, cover, timesheets, people and settings are recorded: who, when and what. Nobody can change or delete that record from inside the app.

How people sign in

No passwords. People sign in with a six-digit code emailed to them. A code lasts 10 minutes, works once and stops working after five wrong tries. Codes are stored only in hashed form.
Face ID or a fingerprint, if they choose. A passkey works only after the phone checks it’s them, only for Backfyl and only on Backfyl’s own address. The face or fingerprint never leaves the phone. Backfyl emails the person whenever a passkey is set up for their email.
Face ID when the app opens. Backfyl asks for Face ID when it opens and after it has been away; until then, the team’s app refuses requests from that device.
Joining needs a manager. People join by invite. Anyone who joins with a shared team link must be approved by a manager before they see anything.
Sign-ins you control. A device stays signed in for up to 12 months. Anyone can sign out a device, or all their other devices, from the menu. When a manager removes someone, their sign-ins end at once.
Limits on repeated attempts. Asking for sign-in codes, signing in and joining are limited for each email address and each internet address, so they can’t be tried over and over.

Encryption

Stored data. Each team’s database and its backups are encrypted at rest with AES-256 by the hosting provider (Railway, or Microsoft Azure for a team hosted in Australia), which manages the encryption keys.

In transit. Everything between a device and Backfyl travels over HTTPS. backfyl.com sends web browsers the Strict-Transport-Security header, so they use HTTPS every time. Notifications to phones are encrypted so that Apple’s, Google’s or Mozilla’s notification service can’t read them.

Backups

Each team’s database is backed up every day, and each day’s backup is kept for 30 days, encrypted like the database. The newest is always kept, so a team is never left without one. The weekly security check confirms that every team has a backup less than 36 hours old.

The weekly security check

An automated check runs every week and looks for:

a team without a recent backup;
a database that can be reached from the internet;
known security problems in the software packages Backfyl uses, with the versions that fix them;
keys or passwords left in the code;
in the week’s changes to the code: anything new without a permission check, one team’s data reachable by another, unsafe database queries, unescaped input in pages, personal details in logs, and public actions without limits;
that backfyl.com uses HTTPS and tells browsers to;
that this page still says only what is true.

What it finds goes to our team to fix.

Error monitoring

When something in Backfyl fails, a technical report goes to Sentry so we can fix it. A report can occasionally include details of the request that failed. Claude, Anthropic’s AI, reads these reports to find the cause and prepare a fix, and a person checks every fix before it goes live.

Payments

Card details go straight to Stripe’s own checkout page. They never pass through Backfyl’s servers, and we don’t store them. For Backfyl Workforce, Stripe receives the number of people in a team, never their names or details.

How long data is kept, and how it’s deleted

While a team is active: everything in it.
Someone removed from a team can’t sign in from that moment. Their name stays on past rosters and timesheets so the history still makes sense; their availability is deleted. On request, their email address is deleted within 30 days.
Anyone can delete their own account in the app. Their email address, sign-in details, passkeys and notification links are deleted straight away.
A cancelled team is kept for 90 days in case it comes back or wants a copy, then the whole app and database are deleted. Whoever set it up is emailed a week before. On request, it’s deleted sooner, within 30 days.
Timesheets and the record of changes can’t be altered or deleted from inside the app, because they are employment records. Keeping them for as long as the law requires is the employer’s responsibility, so download them before closing a team.
Sign-in codes: 10 minutes. Technical logs: no longer than 30 days. Billing records: as long as Australian tax law requires, currently five years. Support emails: up to two years.

What Backfyl doesn’t hold

Backfyl isn’t built to hold health information, patients’ details, or government identifiers such as tax file, Medicare, passport or driver’s licence numbers. Please keep them out of names, tags, requests and messages. A certificate’s own number, such as an RSA or AHPRA registration number, is the one exception, and it’s optional.

The providers Backfyl uses

Each handles only what it needs for its part of the service. We never sell personal information or use it for advertising.

Railway (hosting): runs the backfyl.com website and each team’s app and database, in the Netherlands, and encrypts the stored data and backups.
Microsoft Azure (hosting in Australia), only for a team whose Enterprise agreement includes it: runs that team’s app and database in Sydney, and encrypts the stored data and backups.
Stripe (payments): the owner’s email and payment details. United States and other countries.
Resend (email delivery): the recipient’s address and the email’s content. United States.
Sentry (error monitoring): technical reports of failures. United States.
Anthropic (AI help with support, fixes and reading awards): emails to [email protected], feedback sent from the app, Sentry’s reports, and an award, agreement or pay schedule a team asks it to read; a person checks every reply, fix and pay rate. United States.
Apple, Google or Mozilla (notifications): pass on encrypted notifications to each phone or browser.
Cloudflare (domain names): points backfyl.com addresses at the hosting. Team data doesn’t pass through it.
Xero (payroll), only if a team’s admin connects it: the approved hours the team sends.
Google: the public website’s typeface, and a map when someone opens a tap’s location. The team app doesn’t load anything from Google.

Plainly, for procurement

Backfyl does not hold ISO 27001, SOC 2, IRAP or any other security certification, and has not had an external audit.
Team data is hosted in the Netherlands, unless an Enterprise agreement includes hosting in Australia: that team’s app, database and backups are then in Sydney (Microsoft Azure, Australia East). The backfyl.com website, with account, sign-in and billing records, is in the Netherlands either way.
Stored data is encrypted at rest (AES-256) by the hosting provider (Railway, or Microsoft Azure in Sydney), which holds the keys. Backfyl does not add its own encryption to individual fields.
Sign-in is by emailed code or passkey; single sign-on (SAML or similar) is not available.
If personal information is exposed in a way likely to cause serious harm, we tell the affected teams’ admins promptly and notify the Office of the Australian Information Commissioner where the law requires it. No online service can promise absolute security, and we don’t.

Reporting a security problem

If you think you have found a security problem in Backfyl, email [email protected] with what you found and how to see it. Please don’t access other people’s data while checking. Questions about privacy go to the same address.

Start with four weeks free

Backfyl Workforce runs the whole roster: rosters, allocations, shift cover, leave, tap on and off, timesheets and wage costs. Backfyl Cover keeps the roster you already have and fills the gaps. Nothing is charged until day 29, and you can cancel at any time before then.

Start 4 weeks free