Security

No passwords. No edits in place. Nothing changes quietly.

Roost holds people's records, so it is built the way a record system should be: identity from a directory or a one-time link, permission from one matrix, and a master that never loses where a value came from.

Signing in

A one-time link, or your Microsoft 365 account.

Staff

Invited, never self-registered

Signing in with Microsoft does not create an account. Only somebody already invited to a workspace gets in; the directory says who they are and Roost decides what they may do.

Links

Fifteen minutes, spent once

A sign-in link works once, and the once is enforced by the database rather than by a check that two requests could both pass.

Sessions

Bounded twice

An absolute limit bounds a stolen cookie; an idle limit closes the laptop somebody left in a café.

Permission

One matrix, read by every screen and every action.

Who can do what is one table in one file. Every server action asserts a capability from it; every screen reads it to decide what to draw. Exporting is separate from viewing, because reading one record and downloading ten thousand are different acts. Erasing a person is admin-only and audited.

Roles

Owner, admin, data steward, fundraiser, member services, staff, coordinator, director, finance, viewer.

Branches

A coordinator sees their own club and the people in it. A director sees their area and everything beneath it.

Restricted

Case notes and milestones marked restricted are read only by roles that answer for them.

Guards

Tests that fail the build on an action without a capability check, a form control without a label, or a screen that drifts from the design.

Data

Encrypted at rest, signed in transit, kept in your region.

Provider secrets are encrypted before they are stored and never logged. Deliveries from TellParrot are signed and verified. Roost runs on Microsoft Azure in the region the organisation chooses, with the database on a private network and no public endpoint.

Evidence

Who did what, and where every value came from.

The audit trail records every action with its actor. The master record keeps lineage for every field, so a value on a screen can always be traced to the source that supplied it and the delivery that carried it. A correction shows who asked, who reviewed, and when it landed.

Next step

Ask us the hard questions.

Bring your security questionnaire. We would rather answer it before the first feed than after.

Get started How it works