Built to keep employee data where it belongs
Staffory holds sensitive people data, so security is not a feature bolted on. It is how the system is constructed. Here is what that means, in plain terms.
Tenant isolation, twice over
Every record carries an immutable tenant identifier. Isolation is enforced both in the database (PostgreSQL row-level security, keyed to the request’s tenant) and in the application’s data layer. No client-supplied value can widen access across tenants.
A four-level classification model
Every field is classified Class 1–4 (directory → confidential → restricted → secret). The classification is declared in code and drives who can see what. Restricted and secret data are never placed on search, notification, export or log paths for people who may not see them.
An immutable audit trail
Administrative and security-relevant actions emit audit events: who, what, when, outcome. Audit tables are append-only, with no updates and no deletes, exempt from soft-delete. Reads of restricted data are audited too (counts, never content).
Secrets are encrypted, reveals are gated
Shared credentials (the Vault) use per-item envelope encryption. Revealing one requires a fresh authenticator code, is rate-limited, and is logged. Delete shreds the ciphertext, values never linger in history.
Least privilege, no super-users
Publishing, HR, access-management and Vault permissions are distinct role sets, each granted, audited and revoked independently. There is deliberately no single all-powerful role.
UK data residency
Application data is hosted in the UK (London). Files live in private storage and are served only through short-lived, permission-checked links. A documented restore procedure is exercised as a drill.
How we hold ourselves to it
Security-critical work ships behind an evidence-table discipline: a change to a sensitive surface isn’t considered done until we can show, with automated tests, that the leak paths are closed, a restricted value proven absent from search, notifications, audit metadata, exports and logs; encryption round-trips and tamper-detection proven; cross-tenant access proven impossible. That evidence is reviewed before the change is released.