Security

Security is a design constraint in Staffvelo, not a feature. Here is what we do, in plain terms.

Architecture

• The application runs on Cloudflare Workers at the network edge, behind Cloudflare's DDoS protection and WAF.
• Data is stored in Cloudflare D1 (database) and R2 (uploaded files), encrypted at rest.
• All traffic is served over HTTPS with modern TLS.

Tenant isolation

Each company has its own workspace at company.staffvelo.com. Every database row carries the company identifier and every query is scoped to it; a workspace can never read another workspace's records. Requests to a subdomain that isn't a workspace are refused rather than falling back to another company.

Authentication and access

• Passwords are hashed with bcrypt. Invitations and password links are single-use tokens.
• Sessions are signed, HttpOnly, Secure cookies with a seven-day lifetime.
• Optional Google sign-in (OpenID Connect) on every plan.
• Three access levels plus manager scoping, enforced on the server for every request — not just hidden in the interface.

Application security

Strict Content-Security-Policy, output encoding everywhere, parameterised queries throughout, file-type and size limits on uploads. Payment details go straight to Stripe and never touch our servers.

Email

Transactional email is sent via Resend from a domain authenticated with DKIM, SPF and DMARC.

Backups and continuity

The database keeps point-in-time recovery for 30 days. When a customer asks us to delete a workspace, its data is removed from live systems within 30 days.

Reporting a vulnerability

Please email security@staffvelo.com. We acknowledge reports within two working days, keep you informed, and don't take action against good-faith research.