Security

Security practices we follow: every table in our database uses row-level security, scoping data so one organization can never see another's. Location data (used for shift clock-in verification) is encrypted at rest and only used for attendance purposes. Superadmin accounts require additional device verification. Sensitive administrative actions are recorded in an audit log. We run automated checks against our own database security policies on an ongoing basis. If you have a security concern or want to report a potential vulnerability, please contact us directly rather than filing it publicly.