Hosted in the EU, on SOC 2 Type II audited infrastructure.
ShiftTracker runs on Railway in its EU West region (Amsterdam, Netherlands). Railway is independently audited to SOC 2 Type II and SOC 3. On top of that: TLS in transit, encryption at rest, hardened authentication and role-based access controls.
How does ShiftTracker protect customer data?
ShiftTracker runs on Railway in its EU West region (Amsterdam, Netherlands). Railway is independently audited to SOC 2 Type II. Data is encrypted in transit using TLS and encrypted at rest. Access is protected by hashed passwords, account lockout, rate limiting and role-based controls.
- 01
EU Hosting on Railway
ShiftTracker runs in Railway's EU West region (Amsterdam, Netherlands). Railway is independently audited to SOC 2 Type II and SOC 3, and offers a GDPR data processing agreement.
- 02
Encryption at Rest
Data is encrypted at rest by our cloud infrastructure.
- 03
TLS in Transit
Data is encrypted in transit using TLS, with HTTPS enforced (HSTS).
- 04
Hardened Authentication
Passwords are hashed with bcrypt, repeated failed sign-ins are locked out, and authentication is rate-limited.
- 05
Role-Based Access
Role-based access controls restrict data to authorised users within each organisation.
Is ShiftTracker GDPR compliant?
ShiftTracker is built to align with UK GDPR and is hosted in the EU (Netherlands) to support data residency and compliance requirements.
| Area | Status | Details |
|---|---|---|
| UK GDPR | Aligned | Built to align with UK GDPR |
| Cloud Infrastructure | Active | Railway EU West (Amsterdam, Netherlands) |
| Hosting Provider | Active | Independently audited to SOC 2 Type II |
| Encryption in Transit | Active | TLS, with HTTPS enforced (HSTS) |
| Encryption at Rest | Active | Provider-managed encryption at rest |
| Access Security | Active | Hashed passwords, account lockout, rate limiting, RBAC |
Where is ShiftTracker data stored?
ShiftTracker is hosted in the EU, in Railway's EU West region (Amsterdam, Netherlands). Regular automated backups support disaster recovery.
Need more details?
For security or data protection questions, contact our team and we will share the relevant policy details.