Security

SECURITY POLICY

Our commitment to protecting your data and infrastructure.

Last updated: July 6, 2026

OVERVIEW

RosterLoop is committed to protecting customer data and maintaining a secure platform. This document outlines the technical and organizational measures we implement to safeguard information across our infrastructure, application, and operations.

INFRASTRUCTURE SECURITY

RosterLoop is hosted on a modern, enterprise-grade cloud infrastructure provider. Our infrastructure implements the following controls:

✓ TLS 1.2 / 1.3 encryption on all network connections (HTTPS enforced, no HTTP)

✓ Encrypted data storage at rest using AES-256

✓ Isolated production environments with network-level access restrictions

✓ Regular infrastructure patching and dependency updates

✓ Redundant architecture designed to minimize single points of failure

ACCESS CONTROL

Role-Based Permissions

The RosterLoop platform enforces role-based access control (RBAC). Each user account is assigned a defined role — Owner, Admin, or Member — with permissions limited to what is necessary for their function within the organization.

Internal Access

Access to production systems by RosterLoop team members is restricted on a need-to-know basis, protected by multi-factor authentication (MFA), and logged for auditing purposes. No team member can access customer data without a valid operational reason.

APPLICATION SECURITY

Our development process incorporates security best practices at every stage:

Secure coding standards enforced during development and code review
Input validation and output encoding to prevent injection attacks
Session management with secure, time-limited authentication tokens
Dependencies regularly audited and updated to address known vulnerabilities
Changes to production code follow a controlled deployment process

PAYMENT SECURITY

All payment processing is handled exclusively by Stripe, a globally recognized payment provider certified to PCI DSS Level 1 — the highest level of compliance in the payments industry.

Important

RosterLoop does not store, process, or transmit full credit card numbers or CVV codes on our servers. All cardholder data is handled directly by Stripe.

DATA PROTECTION

Encryption

Customer data is encrypted both in transit (via TLS) and at rest. Database backups are also encrypted and stored securely.

Backups & Disaster Recovery

RosterLoop performs automated backups of customer data on a regular schedule. Backups are retained for a defined period and tested periodically to ensure data can be recovered in the event of an incident. Our disaster recovery plan is designed to restore service within a target recovery window.

Data Isolation

Each customer's data is logically isolated within the platform. Access controls prevent one organization from accessing another organization's data.

MONITORING & LOGGING

RosterLoop maintains system and application logs that capture:

User login and authentication events
Administrative actions and configuration changes
Schedule creation, modification, and deletion events
Payment and billing events

Logs are retained for a defined period and reviewed as part of our ongoing security monitoring. Anomalous activity triggers internal alerts for investigation.

INCIDENT RESPONSE & BREACH NOTIFICATION

RosterLoop maintains an incident response process to detect, investigate, and contain security incidents. In the event of a data breach affecting customer personal data, we will notify affected account owners without undue delay, and in any case within 72 hours of confirming the breach. Our notification will describe the nature of the incident, the data affected to the extent known, and the measures we are taking in response. Account owners are responsible for notifying their own employees or other affected individuals as required by applicable law.

RESPONSIBLE DISCLOSURE

RosterLoop takes security vulnerabilities seriously. If you discover a potential security issue in our platform, we ask that you report it responsibly before public disclosure so we have an opportunity to investigate and remediate.

Report to

info@rosterloop.com — Subject: Security Vulnerability Report

We commit to acknowledging your report within 5 business days and keeping you informed of our progress toward a resolution. We will not take legal action against researchers who act in good faith.

COMPLIANCE

RosterLoop currently implements industry-standard security practices across all areas of our platform. We are actively working toward achieving formal third-party compliance certifications (such as SOC 2 Type II) as part of our growth roadmap. Updates will be posted on this page as milestones are reached.

CONTACT

For security-related inquiries or to report a vulnerability, contact us at:

info@rosterloop.com

Website