Security at SafeShift

1. Infrastructure & Hosting

• SafeShift runs on Render (render.com), a SOC 2–attested cloud platform. We operate no physical servers or on-premise infrastructure.
• The production database is a managed PostgreSQL instance with encryption at rest and point-in-time recovery.
• All public traffic is proxied through Cloudflare, which provides TLS termination, a web application firewall (WAF), and DDoS protection.
• Documents and files are stored in Cloudflare R2 object storage, encrypted at rest, and served only through short-lived pre-signed URLs (15-minute expiry).
• Production and development environments are separated, with automated CI containers serving as the test environment; production data is never used in development.

2. Data Protection

• All data in transit is encrypted with TLS 1.2+. All data at rest is encrypted by our cloud providers (AES-256).
• Passwords are hashed with bcrypt and are never stored or logged in plaintext.
• Especially sensitive fields (such as push notification tokens, MFA secrets, and kiosk PINs) carry an additional layer of application-level encryption or keyed hashing on top of disk encryption.
• Compliance records (break logs, violations, shift edit history) are immutable by design — they are never hard-deleted, preserving them as legal evidence for our customers.
• Every database record is scoped to a customer tenant, and every query is filtered by tenant — customer data is logically isolated at the application layer.

3. Access Control

• Multi-factor authentication (TOTP or SMS) is supported on all manager and owner accounts, and business owners can require MFA for their whole team.
• Role-based access control separates owners, managers, shift leads, and employees; managers can additionally be scoped to specific locations and departments.
• Internal access to production systems is restricted to the engineering team, protected by MFA, and reviewed periodically.
• Sessions expire automatically; web sessions use short-lived, httpOnly cookies.

4. Application Security

• Every code change runs through continuous integration: type checks, linters, and an automated test suite.
• Dependencies are scanned for known vulnerabilities on every push and weekly (pip-audit, npm audit, and GitHub Dependabot alerts).
• Code changes receive an adversarial AI-assisted security review focused on tenant isolation, authorization, and billing integrity before merging.
• Webhooks from payment and POS providers are verified with cryptographic signatures before processing.

5. Monitoring & Incident Response

• Errors and anomalies across backend, web, and mobile are captured in real time (Sentry), with structured log aggregation and alerting (Better Stack).
• Dead-man's-switch heartbeats monitor our background job fleet so silent failures page us instead of going unnoticed.
• We maintain a documented Incident Response Plan and a Business Continuity / Disaster Recovery Plan, reviewed annually.
• Customers are notified of security incidents affecting their data without undue delay, consistent with applicable law.

6. Backups & Continuity

• Point-in-time recovery on the production database, plus independent nightly encrypted backups stored in a separate provider with a 30-day retention window.
• Backup restoration is drilled on a recurring schedule so recovery is a practiced procedure, not a theory.

7. Reporting a Vulnerability (Responsible Disclosure)

We welcome good-faith security research on SafeShift. If you believe you have found a vulnerability, email [email protected] with a description, steps to reproduce, and any relevant proof of concept. We also publish a security.txt file.

Our commitment to researchers:

• We will acknowledge your report within 3 business days.
• We will investigate, keep you informed of progress, and credit you (with your permission) once the issue is resolved.
• We will not pursue legal action against good-faith research that respects the ground rules below.

Ground rules:

• Do not access, modify, or destroy data that is not your own — use your own trial account for testing.
• No denial-of-service, spam, social engineering, or physical attacks.
• Do not publicly disclose an issue before we have had a reasonable opportunity to fix it (we aim for 90 days).
• Automated scanning must be rate-limited so it does not degrade service for customers.

We do not currently operate a paid bug bounty, but we recognize meaningful reports and may offer discretionary rewards for high-impact findings.

8. Reporting a Concern (Whistleblower Channel)

Anyone — employees, customers, partners, or members of the public — can report suspected misconduct, policy violations, fraud, or ethics concerns involving SafeShift through our Confidential Concern Report form. The form collects no sign-in, name, or contact details unless you choose to provide them. Reports are reviewed by company leadership, and retaliation against good-faith reporters is prohibited by our Code of Conduct. You may also write to [email protected].

9. Questions

Security questionnaires, compliance documentation, or anything else: [email protected]. General privacy questions are covered in our Privacy Policy.