An NDIS provider holds some of the most sensitive information there is: health details, disability support needs, incidents, bank and tax details. Rostery is built to keep that information apart, protected and accounted for.
How Rostery protects your data
Every organisation's data is kept apart by row-level security in the database, so each request can only reach its own organisation's records. Free-text notes such as progress notes, incident details and shift notes are encrypted with AES-256-GCM before they are stored, and staff tax file numbers and bank details are encrypted in the database, with every view by another person logged.
Web sessions use secure, HttpOnly cookies with protection against cross-site request forgery, behind strict security headers. Administrators can turn on two-factor sign-in, accounts lock after repeated failed passwords, and passwords found in known breaches are refused. Every change made in Rostery is written to an activity log with who made it, their role, when and from what network address, which administrators and office staff can search and export. Rostery runs on servers in Sydney.
