Security and data handling
This page provides a factual overview of the current beta architecture. It is not a certification, service-level agreement, data processing agreement, privacy notice, or complete security assurance pack.
Service architecture
Section titled “Service architecture”- Public website: hosted on Vercel at
www.fatiguemanagement.co.uk. - Application frontend: hosted separately on Vercel at
app.fatiguemanagement.co.uk. - Application API: hosted on Fly.io at
api.fatiguemanagement.co.uk. - Database and authentication: provided through a dedicated Supabase project.
- Public-site analytics: Google Analytics 4 is present on the public website.
The public educational site does not read the application database.
Authentication and application access
Section titled “Authentication and application access”- Application authentication uses Supabase Auth with email and password.
- The browser uses the Supabase public client key for authentication and session handling.
- Roster, people, location, assignment, policy, and administration operations go through the application API.
- Organisation membership and application roles are checked by the API.
- Current roles are owner, admin, manager, planner, and viewer.
- Server-side credentials are not intended to be exposed to the browser.
Data separation
Section titled “Data separation”Application records are organisation-scoped. A signed-in user must have an active organisation membership before the main workspace is mounted. Workforce records are separate from application member accounts.
Database row-level security is enabled for direct Supabase Data API access. The application API also applies tenant and role checks on its business-data path.
Evaluation and governance records
Section titled “Evaluation and governance records”Fatigue evaluations are stored as immutable snapshots, with a separate pointer to the current evaluation for each assignment. Material roster or policy changes create new records rather than relabelling prior results.
Application mutations create server-side audit events. The current beta does not provide a customer-facing audit-history browser, report export, retention-policy control, or service-level commitment.
Claims not made
Section titled “Claims not made”Fatigue Management does not currently claim:
- ISO certification;
- Cyber Essentials certification;
- regulator or infrastructure-owner approval;
- a published uptime commitment or SLA;
- a published backup or disaster-recovery commitment;
- a complete DPA or subprocessor schedule;
- a final public data-retention policy.
Those items require separate operational and legal review before paid commercial launch.
Procurement and security enquiries
Section titled “Procurement and security enquiries”For questions about the current beta architecture or to request available procurement information, contact hello@fatiguemanagement.co.uk. Do not send passwords, roster contents, employee records, or other organisation-sensitive information by email.