Security at Roz
We're a small team. This page describes what our architecture actually does, in plain terms — not a list of certifications we don't hold. For what we collect and why, see the Privacy Policy.
Where your data lives
Roz runs on Cloudflare Workers. Your workspace data — rosters, shifts, staff details — is held in a managed Postgres database operated by Neon in Sydney (ap-southeast-2), Australia.
How your workspace is kept separate from others
Roz holds many businesses' workspaces in one shared database, not a separate database per business. Every roster table carries a workspace_id column and is indexed on it. Your session resolves to exactly one workspace, and the application filters roster reads and writes to that workspace.
Signing in
Sign-in is handled by Clerk, a dedicated authentication provider. Credentials live with Clerk — we never store or see your password. You can sign in with an emailed link or code, a passkey, Google, or Apple.
Passkeys are the strongest option available. They are tied to your device and cannot be phished or reused on a fake sign-in page.
Inside a workspace, access is role-based: managers can build and publish rosters and manage staff; staff can view their own shifts and request swaps or leave. A workspace's own manager decides who joins it.
Encryption in transit
Roz is served over HTTPS through Cloudflare. A plain HTTP request to rozhq.com is redirected to HTTPS.
AI processing
Roz's AI assistant runs on AI models made by OpenAI and Anthropic, which we reach through OpenRouter. The OpenAI models run on Microsoft Azure and the Anthropic models on Amazon Bedrock, with zero data retention. When you chat with Roz, we send them your message, any photo or file you attach, and the roster data needed to answer — shift dates, times, sites, roles, staff names, and availability. They use this data only to generate Roz's responses, do not store it, and do not use it to train AI models. This data may be processed outside Australia, including in the United States and Europe. Your roster data is still stored in Sydney.
In the iOS app, we ask your permission before Roz sends anything for the first time, and you can withdraw consent at any time in Settings → Data & Privacy. If you don't consent, Roz is disabled and no data is sent; the rest of the app works normally.
Protecting public links
Public, no-sign-in pages — like a shared roster link a manager sends a casual staff member — are rate-limited per visitor, on top of Cloudflare's own edge protection.
Report a vulnerability
Found a security issue? Email [email protected] with details and steps to reproduce it. We read every message and will get back to you. Please give us a reasonable chance to fix an issue before disclosing it publicly.
Your data, your rights
See the Privacy Policy for the full list of what we collect, our sub-processors, and how to request access to or deletion of your data.