Security

How ControlOps approaches application security, access control and operational safeguards for its UK workforce operations platform.

1. Authentication and access

Users authenticate to access the Service. Permissions are enforced through role-based access control so staff only see modules and records their organisation has granted. Portal users are limited to the sites or shifts their role allows.

2. Tenant isolation

Customer data is scoped by company. Queries and APIs enforce company boundaries so one tenant cannot read another tenant's operational records.

3. Transport and session protections

Production traffic is served over HTTPS. Session tokens are stored in browser local storage for the signed-in application session and are not shared across tenants. Sign-out clears the local session.

4. Operational controls

• Audit and activity logging for sensitive administrative and platform actions
• Configurable company roles and module permissions
• Support and live-chat tooling limited to authorised platform operators
• Optional analytics on the public website only after cookie consent

5. Data handling

Customer Content is processed to provide the Service as described in the Privacy Notice and, for processor activities, the Data Processing Agreement. Passwords, payment card numbers and auth tokens are not sent to analytics tools.

6. Business evaluation

Detailed security questionnaires, architecture summaries and sub-processor lists are available to prospective business customers on request under appropriate confidentiality arrangements. Contact [email protected] or Contact.

For questions, book a demo or contact your ControlOps representative.