Staafin handles sensitive workforce information — employee records, rotas, attendance and working-time evidence. We take that responsibility seriously, and we would rather understate a control than overstate one. This page describes what we actually do today.
Access control
- Role-based access: employees, managers and administrators each see only what their role requires.
- Unique logins for every user — no shared accounts in the Staafin app.
- Organisation-level separation so one company's data is never visible to another.
Data in transit
Connections to the Staafin platform and this website are encrypted with TLS (HTTPS). Credentials are never sent or stored in plain text in application code.
Working-time evidence
Attendance events recorded in Staafin carry timestamps and source information, so shift and timesheet records can be audited against who recorded what and when.
Backups and availability
Platform data is backed up regularly and recovery procedures are tested. Our hosting providers operate UK and EU data centres with industry-standard physical and network controls.
What we do not claim
We do not currently hold ISO 27001 or Cyber Essentials certification, and we will not add a certification badge to this site until it is true. Staafin is designed around UK GDPR principles — lawfulness, purpose limitation, data minimisation and storage limitation — and our privacy page explains how that applies in practice. For procurement or due-diligence questions, including any specific control you need documented, please contact us and we will answer directly.
Reporting a security concern
If you believe you have found a vulnerability affecting Staafin, email connect@staafin.co.uk with the subject "Security report". We will acknowledge your report and keep you informed while it is investigated.
Last updated
September 2026.