Provider separation
Every provider context is resolved and enforced server-side so authorised users operate only inside their assigned environment.
Security by design
Workforce data deserves deliberate protection.
Staffarmor combines tenant-aware architecture, least-privilege access and traceable workflows across Admin, Station and employee experiences.
Role-based permissions
Administrative functions are exposed according to explicit roles and permissions, not merely hidden in the interface.
Session control
Short-lived access tokens, refresh-token rotation and session revocation support controlled access across devices.
Identity protection
Dynamic QR tokens are brief and single-use. PIN values are securely derived and never returned to the client.
Auditability
Important administrative, identity, attendance, leave and correction events are recorded for review.
Data minimisation
Public Station views avoid exposing employee lists, while employee interfaces focus on the individual’s own information.
A secure foundation, not a certification claim
Staffarmor is engineered to support controlled and auditable workforce workflows. Regulatory suitability still depends on each deployment, contract and operating process.
Review the security model for your deployment
We can map roles, sites, providers and data flows before a pilot starts.