How we look after your records
Right-to-work documents are sensitive. Here's exactly what RotaProof does to protect them, in plain English.
Documents are encrypted
Every uploaded file is encrypted before it's stored. Without the key, someone who got hold of the files would only see scrambled data.
Two-step login
Protect your account with a code from your phone as well as your password. RotaProof's own admin accounts must use it.
Nightly encrypted backups
Everything is backed up every night, encrypted, and kept for 14 days. An encrypted copy also goes to a separate server with a different hosting company, in France, for 30 days. That server can't open it: the key stays with us. Every week, a backup is restored to prove it actually works.
Your company only
Every page and every file checks that it belongs to your company before it's shown. Other companies using RotaProof can't see your data.
Admin access is logged
If someone at RotaProof opens a document or changes a record to help you, it's recorded, along with who did it and when.
Proof files haven't changed
Each file gets a digital fingerprint when it's uploaded. Your inspection pack checks every file against it.
History can't be rewritten
Once a check is saved it can't be edited. If something was wrong you record a new check, so the history stays a true record.
Only real documents
Uploads must be PDF, JPG or PNG files up to 10 MB. RotaProof checks each file really is what it claims to be.
Safe logins
RotaProof only works over an encrypted connection. Passwords must be at least 12 characters and are stored scrambled. Logins end after 8 hours, or after 2 hours without activity.
Where your data is
RotaProof runs on a server in the UK. Emails such as password resets are sent through Brevo, an email company in France. Our email inboxes are hosted by Unity Tech in the UK. See every company that handles data for us.
Independent checks
- Independent security scan: passed. In September 2026 RotaProof's website and server were scanned from outside by an independent vulnerability scanner. It found no high-risk issues, and the smaller website points it raised have all been fixed.
- Cyber Essentials: in progress. We're working towards Cyber Essentials, the UK government-backed scheme for protecting against common cyber attacks.
What we can't claim yet
- RotaProof hasn't had a full penetration test (where security experts actively try to break in), and doesn't yet hold a certification such as Cyber Essentials or ISO 27001.
We'll update this page as each of these changes. RotaProof also doesn't check documents with the Home Office: read exactly what it does and doesn't check.