Data security and Amendment 13 to the Privacy Protection Law · Shiftyer

How your staff's data is protected. Amendment 13 to Israel's Privacy Protection Law came into force on 14 August 2025. It widened the Privacy Protection Authority's enforcement powers, introduced administrative fines and, in some cases, a duty to appoint a data protection officer. A scheduling

How your staff's data is protected.

Background

Amendment 13 to Israel's Privacy Protection Law came into force on 14 August 2025. It widened the Privacy Protection Authority's enforcement powers, introduced administrative fines and, in some cases, a duty to appoint a data protection officer. A scheduling system holds information about employees, so it is worth knowing how it is protected.

Who sees what

Every company is isolated from every other, and permissions are checked on the server for every request. Employees see their own schedule and requests, managers see their department, and pay data is available to managers only. When Shiftyer support enters a company to fix a problem, the action is written to that company's security log.

Sensitive details

ID numbers, bank accounts and Form 101 details are stored encrypted with AES-256-GCM, and only the employee and their department's managers can open them. Support staff can see that a form exists but not what it says. Two-factor authentication can be switched on for any account.

The schedule assistant

The assistant is off by default and only the company owner can switch it on. When it is on, the department's names, positions, shifts, availability and leave are sent to Anthropic's Claude, without contact details, pay or ID numbers.

Your data

Data can be exported from settings at any time, including after a subscription ends. A closed company stays available to its owner for export, and full deletion happens at the owner's request. See the privacy policy for more.