Hosting and backups
- Shamrock Comply runs on servers in Amsterdam, in the Netherlands, provided by Krystal Hosting Ltd.
- The database and uploaded files are backed up daily. Backups are kept for 31 days and also stay in the EU.
Encryption
- Every connection is encrypted (HTTPS). Browsers are told never to connect without it.
- Passwords and kiosk PINs are stored only as salted hashes, which can't be turned back into the original.
- Kiosk tablets are paired with a one-time link and identify themselves with a secret token, which is also stored only as a hash.
Keeping each company's data separate
- Every record belongs to one company, and every request is checked against the company of the person making it.
- Uploaded files (certificates, documents, photos) are never publicly reachable. Each one is checked against who is asking before it's shown.
- Automated tests check that one company can't reach another's data, and they run before every release.
Who can see what
- Access depends on the role. Administrators see their own company. Site managers see only their own sites. Workers see only their own records. Subcontractors see only their own firm and crew.
- Removed workers and suspended accounts lose access immediately.
- Shamrock Safety Ltd staff only look at a customer's account to support them, and every time it happens it is logged: who, when and for how long.
Logging in
- Sign-in pauses for 15 minutes after repeated wrong passwords, and the kiosk locks after repeated wrong PINs. The login page behaves the same whether or not an email address has an account, so it never reveals who uses Shamrock Comply.
- Invitation and password reset links expire, each can only be used once, and invitation links only ever go to the person's own inbox.
- Login cookies can't be read by scripts in the page and aren't sent to other websites.
- Workers can add Face ID or a fingerprint to confirm sign-ins. That uses the passkey standard: the check happens on their own phone, and no biometric data reaches us. Adding or removing a phone needs Face ID on a phone that's already set up, and every change is logged and emailed to the worker.
Protecting the application
- Every form is protected against cross-site request forgery.
- Database queries use parameters rather than pasted-in text, which prevents SQL injection.
- Security headers stop the site being framed by other websites or files being treated as the wrong type.
- Changes to sign-in records are logged with who made them and why.
If something goes wrong
If we become aware of a breach affecting your data, we'll tell you without undue delay, with what we know, so you can meet your own duty to report it to the regulator within 72 hours. We'll keep you updated as we learn more, and our data processing agreement sets this out.
Reporting a security problem
If you think you've found a security problem in Shamrock Comply, please email info@shamrockehs.com with "Security" in the subject and enough detail for us to reproduce it. Please don't access other people's data or disrupt the service while looking. We'll reply, keep you updated, and thank you.
See also data protection and sub-processors.