Security

Last updated 2 November 2026

StaffFlow handles timesheets, rates and invoices, and has access to the mailbox, storage and accounting system a customer connects. This page describes the measures that protect that data. It describes controls that are in place today; it does not describe plans as though they were in place. It forms part of the technical and organisational measures referred to in our Data Processing Agreement.

Your systems remain the system of record

StaffFlow is designed not to become a second copy of your business. Timesheet documents are filed into your own OneDrive. Invoices are created in your own QuickBooks company, with the timesheet attached as proof. StaffFlow's own database holds what it needs to do its job: your configuration, the hours recorded, invoice references, and the audit history behind them. If you stop using StaffFlow, your documents and invoices remain where they already are.

Separation between customers

• Every record StaffFlow holds carries the customer it belongs to, and every dashboard request is limited to the signed-in user's own customer.
• An incoming email is assigned to a customer at the moment it first arrives, from the mailbox it arrived in. It is never assigned from the email's contents, so a document cannot place itself in another customer's account.
• Files are read and written only through the storage location configured for that customer. StaffFlow refuses to act on a storage location that does not belong to the customer it is working for.
• One customer's data is never used to provide the service to another.

Encryption

• In transit. All connections — between your browser and StaffFlow, and between StaffFlow and Microsoft, Intuit and its other providers — are encrypted with TLS.
• QuickBooks access tokens are encrypted by StaffFlow before they are stored, using authenticated encryption under a dedicated key.
• Two-step sign-in secrets are encrypted by StaffFlow under a separate dedicated key.
• Passwords and recovery codes are never stored. Only a bcrypt hash of each is kept.
• Keys and credentials are held as secrets of the hosting platform, separate from the database and never in source code. Test and demonstration environments use their own separate keys and never hold production credentials.

Access to the dashboard

• Every page and every request requires authentication.
• Two-step sign-in with an authenticator app is supported, with single-use recovery codes.
• Repeated failed sign-in attempts temporarily lock the account.
• Sessions are held in a secure, HTTP-only cookie that page scripts cannot read, and expire after twelve hours.
• Roles separate users who may approve and change records from users with read-only access. A user's role is checked against the current record on every change, so revoking a role takes effect immediately.

Access to your mailbox, storage and QuickBooks

• Access is granted only by an authorised administrator of your Microsoft 365 tenant or your QuickBooks company, through that provider's own consent screen, and can be revoked there at any time.
• StaffFlow requests the narrowest access it needs: to receive timesheets, file documents, read customers, create invoices, and read the status and payments of those invoices. It does not read bank feeds, payroll, or transactions unrelated to the invoices it creates.
• Change notifications from Microsoft are verified before StaffFlow acts on them.
• StaffFlow's automated endpoints each require a secret, compared in constant time. A missing or wrong secret is refused.

Artificial intelligence, and its limits

StaffFlow uses Microsoft Azure AI Document Intelligence and OpenAI to read timesheet documents. They read; they do not decide.

• Every figure a model reads is checked by fixed rules against the document itself, including the document's own printed totals and dates.
• Where a figure cannot be verified, StaffFlow holds it for a person rather than guess. A held item shows the reason it was held.
• No invoice is created without a person approving the period first.
• Your data is not used to train any model, by StaffFlow or by its providers. Azure Document Intelligence deletes documents 24 hours after processing. OpenAI may keep request data for up to 30 days solely to detect abuse, and then deletes it.

Audit trail

• Every approval, correction, discard and closure is recorded with the user who made it, the time, and the reason.
• Changes to placement records — rates, dates and assignments — are kept as a change history.
• Where a person corrects a figure, the record shows that it was corrected by a person, not read from the document.
• Items put on hold keep a record of what they were before and after the hold was resolved.

Monitoring and reliability

• Every processing failure is recorded and raises an alert to the operator. Failures that can be retried safely are retried automatically.
• StaffFlow alerts if a customer's mailbox stops delivering timesheets for longer than expected, so a broken connection is found within days, not at month end.
• An independent check alerts if StaffFlow's scheduled work stops running.
• A document is never billed twice: each email is recorded when first received, and a repeated delivery is recognised and ignored.

Operator access

StaffFlow is operated by a single operator. Administrative access to production systems is limited to that operator. In the ordinary course of support, the operator reviews error logs and processing outcomes, not the contents of timesheets. Where reading a specific document is necessary to resolve an issue you have raised, only that document is read, and only to the extent necessary.

Providers

StaffFlow is hosted on Railway, including its own self-hosted n8n workflow engine, and its dashboard is served by Cloudflare. The providers that process customer data, what each receives, and how long each keeps it are listed in Annex 3 of the Data Processing Agreement. You will be told at least fourteen days before a new one is added.

Retention and deletion

Configuration, hours and invoice records are kept while your account is active, because they are the audit trail behind invoices already issued. You can download a complete copy of your data at any time.

When your account is closed, a full export is sent to your admins automatically, and you have fourteen days to change your mind. After that, StaffFlow's access to your QuickBooks is revoked, your mailbox is no longer monitored, and your records are deleted, all within thirty days of closing. Backup copies are never restored selectively and expire within about ninety days. Files in your own OneDrive and invoices in your own QuickBooks stay with you. The details are in the Data Processing Agreement.

Incidents

If a security incident affects your data, you will be notified without undue delay and in any event within 72 hours of StaffFlow becoming aware of it, with what happened, what data was affected, and what is being done. StaffFlow will work with you on any notice you are required to give.

Reporting a vulnerability

If you believe you have found a security vulnerability in StaffFlow, please write to hello@staffflowpro.com with "Security" in the subject line. Please give us a reasonable time to fix it before disclosing it, and do not access, change or delete data that is not yours while investigating. We will acknowledge your report, keep you informed, and will not pursue action against good-faith research that follows these terms.

Questions

Customers and prospective customers may request written answers to a security questionnaire at hello@staffflowpro.com.