What we actually do to keep your company’s data separate, private, and yours.
Every company's data lives behind Postgres Row-Level Security policies, not just application code. A query without the right tenant context returns nothing, by default, at the database itself, not just because the app happened to filter correctly.
The app and API are served over HTTPS. Credentials and session data never travel in plain text between your browser or field app and our servers.
Account passwords are hashed with bcrypt before they ever touch the database. Invite links and reset-style tokens use a separate one-way hash so a database leak can't hand out working credentials.
Viewing analytics, managing payroll, managing staff, and managing settings are each independent permissions. Give a site supervisor exactly the access they need, no more.
GPS is captured at the moment of a clock-in or clock-out, to check it against a site's geofence, not tracked continuously in the background. See our Privacy Policy for the full breakdown of what's collected and why.
Punches, incidents, and shift changes are timestamped records, not values that get overwritten. If something needs to be reviewed later, the history is there.
Found something that looks like a security problem? We’d genuinely rather hear about it directly than have it posted publicly first. Email us using the address on the Contact page with what you found and how to reproduce it.
You can request deletion of your account and associated personal data at any time, subject to records we’re legally required to keep. See the Privacy Policy for details.