Data Practices
What RostrOps is
RostrOps is a multi-tenant workforce-authority platform for industrial construction. It records site presence, supervision authority, assigned work areas, attendance status, transfers, call-ins, time-off, timesheets, audit events, and customer billing records.
Important boundaries
- NFC cards are ID tokens, not biometric identifiers.
- Worker photos are plain ID photos. RostrOps does not perform facial recognition.
- The platform has no dedicated fields for SSN, dates of birth, government IDs, protected-class demographics, payroll rates, or financial-account/card data. Users should not submit them; free text and uploads may still contain personal or sensitive information.
- Call-in documents are not uploaded or stored; only metadata that documentation was provided is recorded.
Data location and providers
RostrOps runs on Microsoft Azure: the inspected API/database are in Central US and file storage is in East US. Application Insights processes operational diagnostics. Other vendors and global delivery require separate processing-location confirmation. Transactional email uses Resend, mobile push uses Expo, and optional customer-enabled AI features use Anthropic with recognized worker/leader identities tokenized before egress; residual free text/context may still identify people. Site-location/weather functionality uses conditional Tomorrow.io, US National Weather Service, Open-Meteo, Nominatim and timeapi.io.
Operational caveats
- RostrOps is intentionally a worker-monitoring system for on-site presence, authority, location, and attendance. Customers need appropriate worker notices and consents where required.
- Audit logs and finalized billing records retain identifiers; their lawful duration and disposal process remain to be finalized. Archiving does not delete a tenant.
- Self-scan uses a selfie and a single phone-location reading. Worker anonymization queues live photo deletion; attached active-worker evidence has no automatic expiry. Database backups and Blob soft-delete are 14 days; versioning is enabled and may retain previous versions separately.
- Full-tenant export/deletion has no demonstrated end-to-end manual process or self-service feature. A deliverable scope, procedure and deadline must be approved before contract commitments.