Security.
How WrapDesk keeps crew timesheets and job details safe, in plain words, saying only what is in place today; anything marked Planned is not in place yet. Short version: the SIN goes on the timesheet PDF, saved to a private folder for the job; the production manager’s online area holds no SIN, rates or banking, and each production manager sees only their own jobs.
Where it lives
Crew timesheets are saved as PDFs to a private Dropbox folder for each job. The folder is shared by name with that production’s payroll people; they and WrapDesk are the only ones who can open it. It is never shared as an open “anyone with the link” link.
The production manager’s online area keeps only a job’s name, its crew list (name, position, timesheet received or not) and the questions WrapDesk asks with their answers, in a hosted database (Supabase). Everything travels over HTTPS. Planned: the database sits in Supabase’s Canada (Central) region.
Who can open what
A production manager signs in and sees only their own jobs, their crew and their questions. They can add an answer but never change or delete one. A production manager taken off a job sees nothing from that moment, and someone who isn’t signed in sees nothing. Nobody signs themselves up: WrapDesk invites each production manager.
These rules are tested on every table of the online area. Planned: the same tests against the live project, before the first production manager signs in.
SINs and banking details
Payroll needs a SIN to pay crew and to issue their tax slips, so the timesheet asks for it. It goes on the timesheet PDF, saved to the job’s private folder. It is not saved on the timesheet’s server or in the phone’s saved draft, and it is never in the production manager’s online area or in the timesheet link: the online area has no place to store a SIN, rates or pay, and a test fails if one ever appears. We don’t collect banking details.
The timesheet link
The job’s details are written into the timesheet link and signed with a key only the timesheet service has. A changed or unsigned link is refused, and a link expires on its own, ten days by default. The link can send a timesheet but never read one, and it never holds crew details, a SIN, rates or banking.
The keys
The one key that can change the online area’s data stays on one computer in the WrapDesk office, never in the pages or the code’s history. The pages carry only a read key, which opens nothing without a sign-in.
How long we keep it
A job’s timesheets and records are kept for 12 months after its final package goes to accounting, then deleted. Planned: the step that deletes them on that schedule.
Before the first production manager
Planned: an outside developer reviews the access rules, the sign-in settings, the keys and the hosting before the first production manager is invited, in early December.
If something goes wrong
If a breach of security puts personal information at a real risk of significant harm, we tell the Office of the Privacy Commissioner of Canada and every person affected as soon as feasible, as PIPEDA requires, and we tell the production managers whose jobs were touched the day we know. We keep a record of every breach, and of what we did about it, for 24 months.
Reporting a problem
If you find a security problem, write to wrapdesktoronto@gmail.com. We answer within one working day and say what we did about it.