Platform · Staff records

Set the rule once at the top, and it reaches every employee below it

Everything else in SkyRoster reads from one organisation model: a tree of units, each carrying a contract of scheduling rules that cascades down to sub-units and employees, and one employee record every module treats as the source of truth.

Structure

A tree of units, not a flat employee list

A unit is an org-chart node, a tower, an approach room, a shift team, each with a parent unit, any number of sub-units, a primary and secondary Head of Unit, a unit code and its own timezone. Alongside the flat list, an expandable tree view shows the full chain of command at a glance.

A unit can be flagged non-operational, a way to keep an administrative or holding node in the org chart without it being treated as part of live rostering logic. Each unit also carries its own contact details and full postal address, useful for a multi-site or multi-country organisation where every control room has its own official address.

Contracts

One contract, inherited automatically, overridden deliberately

Every unit carries a contract, the bundle of rules that governs scheduling for everyone under it: annual leave allowance, carried-over days, monthly caps on off, work, swap and preferred-day requests, the minimum notice period before a roster can be published, a monthly overtime ceiling, and a maximum number of employees who may be absent at once (which can be set to unlimited).

Propagation

Change a contract value at the top and it cascades automatically through every sub-unit and employee beneath it. This runs as genuine recursive propagation through the whole subtree, not a value computed fresh each time someone opens a screen, so an allowance change on Monday is already reflected in Tuesday's Bank of Working Hours calculations.

Read-only contract

A flag that shields a specific unit, and its entire subtree, from changes coming down from its ancestors, while still letting that unit cascade its own contract changes downward to its own children. A senior team with a genuinely different overtime allowance stays different on purpose.configured

An individual employee can also carry a custom contract that overrides what their unit would otherwise hand down, for the cases where the exception is personal rather than organisational.

Calendars

Holiday calendars, and the mechanism behind a bridge day

Holiday calendars

Each unit is assigned one or more named holiday calendars, used by the roster engine to treat public holidays correctly. A multi-country organisation can run several calendars at once, each unit observing whichever applies to it.

Bridge days

A working day between a public holiday and a weekend, granted as a day off in the unit's holiday calendar. The mechanism that matters: unlike a public holiday itself, a bridge day counts as a regular working day in leave-balance and allowance calculations, so it does not quietly inflate an employee's entitlement the way a true holiday would.

Governance

Two roster-publishing toggles, and one filter that reaches everywhere

Who may publish

Each unit independently decides whether only its Head of Unit may publish a draft roster, and whether publishing automatically triggers a feasibility check. See strategic rostering.configured

Global unit filter

A navbar-level filter narrows nearly every major screen, the leave scheduler, draft and published rosters, the qualification matrix, the staff list, down to just the units a manager selects, without reconfiguring each screen separately.

The employee record

One record, read everywhere, owned nowhere else

Personal data, contract, address, profile picture and documents live on a single employee record. Leave, duty, swap and work-request features never keep their own copy of employee data, they read this one record through a shared interface, so a change made once is correct everywhere at once.

Sensitive fields, fiscal number, ID or passport number, address, phone, are exposed only through endpoints gated at a stricter write-privilege tier than the general employee list, deliberately narrower than what a roster viewer can see. An employee viewing their own confidential data needs only ordinary individual-level access.

Documents

Five categories, encrypted at rest, checked at the row

Five categories

Personal, Managerial, Qualification, Leave and Duty, each attachable from desktop or as a phone photo, gallery pick or file pick on mobile.

Encrypted at rest

File content is encrypted before it is written to storage and decrypted only when read. Metadata and file bytes are held in separate stores, joined only by an internal identifier.

Checked at the row, not just the door

Downloading a document is not just knowing its identifier, the request is checked against the employee it actually belongs to, every time. Uploads are capped at 15MB and limited to a defined set of file types.

See data protection for how this fits the wider security model, and access control for how the membership and role system that gates all of this actually works.

Identity

The job number, and why it has to be searchable everywhere

Every employee carries a job number, the payroll and HR identifier shown under their name on rosters and schedulers. Every screen that filters or searches employees by name accepts the job number too, because in a large ANSP, a name is rarely a unique enough key to work from quickly.

Bring your actual org chart.

Multi-unit contracts, bridge days, an exception for one senior team, every organisation's structure has its own wrinkles. Bring yours to a working session and we will model it live.

Book a working session Send a question instead

Who else will ask, and what they will want