Security
Your payroll is nobody else’s business. Ours included.
Software holding staff records and pay figures for more than one company has to keep them genuinely apart, and be straight about the bits it has not done yet. Here is both.
Your workspace
Lough Haulage
- People
- 48
- Timesheets
- 2,214
- Leave requests
- 386
- Payroll runs
- 97
Every other company
0
records you can see, read or change
One company’s records can never become another’s.
This is the thing that matters most and the thing nobody can check from the outside, so it is worth being clear about how it works rather than asking you to take it on trust.
Sealed off where it is stored
Your records are kept apart at the point they are saved, not by our software remembering to ask the right question each time. That is the difference between a rule and a habit, and only one of them holds up on a bad day.
We try to break it on purpose
Reaching across from one company’s account into another is something we test for directly: a suite connects as the application itself and checks that reading, writing, changing and deleting another company’s records all fail.
Only named paths can look across
A small set of jobs has to see past the wall — signing in and signing up, working out whose web address or public link this is, scheduled jobs, billing, and our own staff console. Each one is named in the code with the reason it needs to.
What that means day to day
The rest of it, plainly.
Our staff are not users in your account
Weekyard’s own people sit entirely outside your workspace. They take up none of your seats, appear in nobody’s staff list, and sign in through a separate door that times out in hours rather than weeks.
Receipts are not a link anyone can stumble on
An uploaded receipt is shown only to the person who claimed it and the people allowed to approve their claims — their manager and your admins. Guessing its web address gets nobody else in.
Nine levels of access, one that cannot touch anything
Access follows the structure you already have. An auditor can open the reports and the payroll figures without being able to approve or change a single thing.
For your IT or security team
The technical detail, if you want it.
Everything above, said properly — for whoever your procurement process puts in the room. Open what you need.
How is one customer’s data kept from another’s?
By the database itself, using Postgres row-level security. Every query runs inside a transaction that pins which workspace is asking, and a policy on every table checks that against the row before returning it. The application connects as a role that is neither a superuser nor able to bypass those policies, and it checks that on its first query and refuses to run any query on a connection that could bypass them. The isolation is covered by a test suite that connects as the application role and asserts that cross-workspace reads, writes, updates and deletes all fail.
How are passwords and tokens stored?
bcrypt with a cost factor of 12, never logged or stored in the clear. The secrets a clock terminal holds are stored only as hashes. Sessions are rows in the database referenced by an opaque id in an HTTP-only cookie — there is no JWT, so revoking a session takes effect immediately rather than at expiry.
How long do sessions last, and does signing out end them?
Thirty days, renewed as the person uses it. Signing out deletes the session there and then, and a person who is deactivated is refused on their next request rather than when their session would have expired. Our own staff use a separate console with its own sessions, which last twelve hours.
What security headers does the site send?
Content-Security-Policy, Strict-Transport-Security with includeSubDomains, X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, and a Permissions-Policy that disables camera and microphone.
How does rate limiting identify a caller?
Sign-in, signup and candidate routes are limited on the client address taken from the edge proxy’s forwarded-for header. The proxy replaces that header rather than appending to it, so a client cannot prepend a value of its own and make every failed attempt look like it came from a new address. Past the limit, further attempts from that address are refused for a time.
How are custom domains and certificates handled?
A domain is routed only once a _weekyard TXT record on it has been seen, and certificates are issued on demand for hostnames we actually serve. The endpoint the proxy consults before issuing is refused from the public internet, so it cannot be used to enumerate which domains belong to which customer.
Where are uploaded files kept?
Receipts are stored in Postgres alongside the claim they belong to, rather than in an object store, so they share its backups and its row-level security, and are served through a route that checks the viewer is the claimant or someone allowed to approve their claims. Organisation logos are public by design, because they appear on careers pages.
Straight answers
What we do not claim.
A security page that only lists strengths is a sales document. These are the things you would find out later anyway.
We are not SOC 2 or ISO 27001 certified
No audit has been carried out and we will not imply otherwise. If a certificate is a hard requirement for you, say so — that is a conversation about timelines, not a badge we are going to quietly drop into a footer.
If you stop paying, your records do not vanish
Fourteen days of normal access, then sixteen where you can still open and read everything but not change it. This holds pay and attendance records. Locking a company out of those the moment a card fails causes arguments far worse than an unpaid invoice.
Found a problem? Tell us
Report anything you find to security@weekyard.com. We will acknowledge it, and we will not reach for a lawyer first.
Put it in front of your own IT people.
Start a trial, hand it to whoever signs off software where you work, and send us whatever they come back with. We would much rather answer a hard questionnaire now than a complaint later.
No card required. From £6 per person a month plus VAT afterwards, minimum 10 people.