Security at Roz
We're a small team. This page describes what our architecture actually does, in plain terms — not a list of certifications we don't hold. For what we collect and why, see the Privacy Policy.
Where your data lives
Roz runs on Cloudflare Workers. Your workspace data — rosters, shifts, staff details — is held in a managed Postgres database operated by Neon in Sydney (ap-southeast-2), Australia.
How your workspace is kept separate from others
Roz holds many businesses' workspaces in one shared database, not a separate database per business. Every roster table carries a workspace_id column and is indexed on it. Your session resolves to exactly one workspace, and the application filters roster reads and writes to that workspace.
Signing in
Sign-in is handled by Clerk, a dedicated authentication provider. Credentials live with Clerk — we never store or see your password. You can sign in with an emailed link or code, a passkey, Google, or Apple.
Passkeys are the strongest option available. They are tied to your device and cannot be phished or reused on a fake sign-in page.
Inside a workspace, access is role-based: managers can build and publish rosters and manage staff; staff can view their own shifts and request swaps or leave. A workspace's own manager decides who joins it.
Encryption in transit
Roz is served over HTTPS through Cloudflare. A plain HTTP request to rozhq.com is redirected to HTTPS.
AI processing
Roz's AI assistant is powered by Claude, from Anthropic. When you chat with Roz, we send Anthropic your message, any photo you attach, and the roster data needed to answer — shift dates, times, sites, roles, staff names, and availability. Under our commercial agreement, Anthropic does not use this data to train its models, and keeps it only briefly for abuse monitoring.
In the iOS app, we ask your permission before Roz sends anything for the first time, and you can withdraw consent at any time in Settings → Data & Privacy. If you don't consent, Roz is disabled and no data is sent; the rest of the app works normally.
Protecting public links
Public, no-sign-in pages — like a shared roster link a manager sends a casual staff member — are rate-limited per visitor, on top of Cloudflare's own edge protection.
Report a vulnerability
Found a security issue? Email [email protected] with details and steps to reproduce it. We read every message and will get back to you. Please give us a reasonable chance to fix an issue before disclosing it publicly.
Your data, your rights
See the Privacy Policy for the full list of what we collect, our sub-processors, and how to request access to or deletion of your data.