Organisation and role access
Operational records are structured under organisation identifiers. Access rules evaluate organisation membership, role and venue assignment before allowing supported actions.
- Owners and authorised managers receive administrative access for their organisation.
- Staff workflows are limited to their own records and assigned venues where applicable.
- Organisation switching keeps each organisation's working context separate.
- Disabled accounts and revoked memberships lose access to organisation workflows.
Sensitive records and documents
Worksheets uses Firebase and Google Cloud services for authentication, database storage, file storage and document processing. Sensitive staff profile fields are encrypted by the service, and access to stored records is controlled through server-side rules and authorised backend operations.
Receipts and invoices may be processed by Google Cloud services for OCR. Temporary batch processing is designed to return structured output without retaining source images after the temporary processing window.
Operational safeguards
- Important administrative and workflow actions retain audit information.
- Venue coordinates and QR tokens are stored outside public application JavaScript.
- Clock actions can record limited GPS verification without continuous location tracking.
- Production and staging environments are separated for development and testing.
- Automated security rules tests cover organisation and role boundaries.
No online service can promise absolute security. Controls are reviewed and improved as the service changes.
What organisation administrators should do
Use individual accounts, assign the lowest role and venue access a person needs, remove access promptly when employment changes, review unusual timesheet or GPS warnings, and avoid sharing QR codes outside their intended venue.
Users should protect their sign-in details, use secure devices, sign out of shared computers and report unexpected access or account activity.
Report a security concern
Send credible security concerns to worksheetsxyz@gmail.com. Include the affected area, what you observed and when it occurred, without sending passwords or unnecessary personal records.
For information about personal data, read the Privacy Policy.