Security & your data
Your firm’s data, and only yours
Payroll records are worth looking after properly. Here is exactly how Costworks does it — and, just as plainly, what it does not claim.
- AWS, London
- Encrypted connections
- Append-only audit log
- One firm per account
Where it lives
In London, behind an encrypted connection
Costworks runs on Amazon Web Services in the London region. The application and its database both run there.
AWS eu-west-2
The application server and its MySQL database are hosted in London.
Encrypted in transit
Every page and every request goes over TLS, and browsers are told never to connect any other way. Strict security headers stop the app being shown inside somebody else’s page.
No copies on phones
Hours are saved straight to the server. There is no offline copy of anybody’s timesheet sitting on a phone that might be lost on site.
Signing in
Passwords that are hard to guess and hard to steal
An email and a password is all the crew have to remember, so everything behind them is built to make guessing and stealing them slow and loud.
rounds of PBKDF2-HMAC-SHA256 on every password, with its own salt.
wrong passwords lock an account for fifteen minutes.
is the most an access token lives; sessions renew quietly behind it.
is the life of a password-reset link, and it works once.
Rate limits and a network throttle
Sign-in, password reset and company set-up are rate limited before they do any work, and a network with too many failed guesses is turned away for a while.
Sessions that notice theft
A signed-in device holds a session that renews each time it is used. If an old session token is ever used twice, every session in its family is revoked.
A reset signs out everywhere
Using a reset link, or an office reset, revokes every session the account held — because a reset usually means a password was seen by the wrong person.
Nothing given away
A wrong address and a wrong password get the same answer in the same time, and reset emails carry no name, so nobody can use them to find out who has an account.
Owners guard the office
An admin manages the crew’s sign-ins; only an owner can reset, invite or suspend an admin or another owner.
Leavers are out on the day
Archiving somebody suspends their sign-in at once, so a leaver cannot still send a week in.
Records
Nothing thrown away, everything written down
A payroll question three years from now needs the row that was there at the time, and the name of whoever changed it.
- Nothing is hard-deleted. People, clients and jobs archive; a removed shift or material is marked removed, not erased.
- An append-only audit log. Approvals, send-backs, reopenings and rate changes are recorded. The application’s own database account can add to the log and read it — and has no permission to edit or delete a line of it.
- Dated, never overwritten. Pay rates and pay rules carry the date they start, so the rate for any day is the one that was in force on it.
What we hold
Only what a timesheet and a gross figure need
The safest data is the data that was never collected.
What Costworks holds
- Names and sign-in email addresses
- Hours, jobs, materials and nights away
- Pay rates, pay rules and holiday entitlement
- Clients and their contact details
What it never asks for
- National Insurance numbers
- Bank details
- Where anybody is — no location tracking
- Anything payroll filing needs: that stays with your payroll
Straight answers
What we do not claim
Better said here than discovered later.
No two-factor sign-in yet
Sign-in is an email and a password, with the protections above. If two-factor sign-in matters to your firm, tell us.
No certificates claimed
Costworks does not hold an ISO 27001 or Cyber Essentials certificate. What it has is described on this page, and we will answer any question about it.
Hosted in one place
Costworks runs in one AWS region, London. Ask us about backups and recovery and we will tell you exactly how it is set up today.
Questions
About security and your data
Where is our data kept?
On Amazon Web Services in London (the eu-west-2 region), in a MySQL database. Every connection to it from a browser or phone is encrypted.
Can another firm using Costworks see our data?
No. Every record carries the company it belongs to and every query is fenced to the company of the person asking. A test suite of its own signs in as one firm and tries to read and change another firm’s records, and checks the database afterwards.
Do you hold National Insurance numbers or bank details?
No. Costworks holds what a timesheet and a gross pay figure need: names, sign-in emails, hours, jobs and rates. No NI numbers, no bank details, and no location tracking.
What happens when somebody leaves?
Archiving them suspends their sign-in at once, so they cannot send a week in or see anything. Their records stay, because a payroll question years later needs the hours that were there at the time.
Is there two-factor sign-in?
Not yet. Sign-in is an email and a password, protected by strong password hashing, lockouts after repeated wrong guesses, rate limits, and sessions that can be revoked. Ask us if two-factor sign-in matters to your firm.
Ask us anything about your data
Your accountant, your insurer or your own IT person can put their questions to us directly. We will answer them straight.