Summary
Security isn't a feature we bolted on — it's the foundation of how NestedClock is built. From data isolation to encrypted credentials to role-based access control, every layer is designed to protect your business data.
Data Isolation: Your Data Is Yours Alone
Every business on NestedClock gets complete data isolation. Your data is stored separately from every other customer. This means:
- No shared storage — there is no shared database where a bug could leak data between businesses
- Independent scaling — your account scales independently based on your usage
- Clean deletion — when you leave, your data is fully removed with no risk of affecting other customers
- Audit clarity — every record belongs to exactly one business, no ambiguity
Every API request is validated against the authenticated user's identity. A user from Business A cannot access Business B's data — the request is rejected before it reaches the database.
Authentication & Access Control
Admin & Manager Authentication
Admins and managers authenticate with email and password through an enterprise-grade identity service. This includes:
- Secure password hashing
- Short-lived authentication tokens
- Automatic token refresh
- Account lockout after failed attempts
Staff PIN Authentication
Staff clock in using a 4-digit PIN at the kiosk. PINs are:
- Encrypted at rest — never stored in plaintext
- Validated server-side — sent over HTTPS, verified on the server, and discarded
- Unique per shop — the same PIN can exist in different shops but not within the same shop
Role-Based Access Control
Three roles with distinct permissions:
| Role | Can Do | Cannot Do |
|---|---|---|
| Admin | Everything — staff, shops, rosters, settings, billing, AI | — |
| Manager | Staff, shops, rosters, leave, monitoring, AI | Settings, billing, plan changes |
| Staff | View own timesheet, roster, messages | Access other staff data, admin functions |
API Security
- Authentication required on every endpoint — no anonymous access to any data
- Business validation on every request — cross-checked against the authenticated user's identity
- Origin restrictions — only requests from authorised domains are accepted
- Security headers — industry-standard headers on all responses
- Input validation — all inputs validated for type, length, and format
- Write protection — data modification requires admin or manager role
Encryption
- In transit — all traffic is HTTPS/TLS 1.2+
- At rest — all databases and storage are encrypted
- PINs — additionally encrypted at the application layer before storage
- Photos — stored with server-side encryption, accessed via time-limited secure URLs
AI Security
The AI features (Assistant and Agent) have additional security layers:
- Business-scoped queries — the AI can only access the authenticated business's data
- No cross-business data — even if a user asks about another business, the AI has no access
- Secure action confirmation — the Agentic AI requires explicit user confirmation before any change, with tamper-proof verification
- Audit logging — every AI agent action is logged with timestamp, user, and action details
- No model training — the AI provider does not use your data to train models
Infrastructure Security
- Minimal permissions — each service component has only the permissions it needs
- Fully serverless — no operating systems to patch, no ports to close, no SSH keys to manage
- Region-locked — infrastructure is restricted to Australian regions at the account level
- Auto-scaling — infrastructure scales automatically, reducing denial-of-service risk
What We Don't Do
- We don't store passwords in our database — handled by a dedicated identity service
- We don't log sensitive credentials
- We don't share data between businesses — ever, for any reason
- We don't send data overseas — all processing stays in Australia
- We don't use your data to train AI models