| Question | Answer |
|---|---|
| Which deployment options are available? | Three shapes: shared SaaS on infrastructure we operate, dedicated SaaS reserved for your organisation, or your own infrastructure, self-hosted on Kubernetes. Shared hosting is included in the software licence; dedicated hosting is priced separately and is required for bespoke code outside the standard supported release or requested isolation. Changes included in the standard supported release do not themselves trigger dedicated hosting. Standard product releases use the same codebase across these shapes. Customer-specific code has a separately agreed release and maintenance scope. Configurable |
| Is our data isolated from your other customers? | Each tenant has a separate Keycloak identity realm and database on both shared and dedicated deployments. Review tenant routing, access controls and isolation tests for the deployed environment. |
| Can we sign in through our own identity provider? | Yes: Microsoft Entra ID (Azure AD) through Keycloak's OIDC federation, or an on-premises Active Directory through LDAP, with optional Kerberos for a passwordless internal login. Your staff sign in with the credentials they already have; you keep control of the account lifecycle. Configurable |
| Can new starters and leavers sync from our directory automatically? | A scheduled LDAP sync creates and updates employee records from Active Directory. It does not deactivate employees removed from the directory; offboarding requires a separate administrator action. Configurable |
| How fine-grained is the permission model? | Read and write scopes are configured independently across sixteen permission areas, using seven levels from no access to the whole organisation. Selected business actions have separate permissions. Write scope is limited to the read scope for the same role and area. |
| Is access enforced only in the interface, or in the data as well? | Protected endpoints and handlers check operation privileges, and secured repositories apply employee and unit scopes. Coverage differs between persistence paths. Include direct API and target-record authorization tests for the workflows and roles in your deployment. |
| Are uploaded employee documents, IDs, licences, medical certificates, encrypted at rest? | Supported uploaded-document storage encrypts file content. Key management and legacy-file coverage must be reviewed for the deployment. General employee responses separate confidential fields; history and exports have additional access paths and must be included in the permissions review. |
| Is there a change-audit trail we can hand to our own auditors? | Audit & History provides actor, time and before/after values for supported recorded changes. Confirm the implemented coverage, permitted viewers, retention and any export requirement in the written offer. It is not an exhaustive or tamper-proof record of every action. |
| How are service-to-service calls authorised? | The gateway strips the external caller's internal-call marker. User-facing calls propagate a security context, while background jobs and message consumers have service contexts. Review those privileges and the deployed network boundary together. |
| Has the platform been independently tested for security issues? | Request the current assessment scope, tested version, open findings, remediation evidence and regression coverage during evaluation. This page does not establish that every finding is closed or that every deployment has the same tested controls. |
| How is a tenant decommissioned? | Tenant decommissioning removes the identity realm and database and revokes stored secrets. Agree data export, deletion confirmation and treatment of retained backups as part of the exit plan. |
For your team · IT and security
Assess SkyRoster against your IT requirements.
Review identity integration, permissions, hosting and service responsibilities before deployment. Use the technical questions below to identify the controls and evidence your team needs to assess.
Work through the technical requirements.
Deployment responsibilities
Define responsibilities for your deployment.
Shared and dedicated SaaS include a 99.5% uptime SLA, daily backups and standard application updates on Microsoft Azure in the EU. Dedicated hosting does not automatically increase the SLA. Recovery objectives, support response times and additional commitments are specified in the relevant contract.
For self-hosted deployments, your team manages infrastructure, security, updates and backups. Audit & History covers supported recorded changes; it is not an exhaustive or tamper-proof record of every action.
Review security controls → · Compare deployment responsibilities →
Scope the technical part of your evaluation.
Start with a 20-minute discovery call about your infrastructure and assurance requirements. We’ll use those priorities to scope the technical review alongside a tailored demo or evaluation.