How we protect guard and employer data

Government IDs, security license photos, W-9/tax forms, and background check reports are encrypted with AES-256-GCM on our server before they're ever written to storage. The plaintext file is never saved anywhere; it exists only in memory for the moment it takes to encrypt it.

This is different from "the database is encrypted," which is table-stakes and true of almost every cloud database by default. Here, the sensitive fields themselves are ciphertext, unreadable even to someone with direct database access, unless they also hold the encryption key.

Being an app administrator is not sufficient to decrypt a guard's sensitive documents. Access requires a second, explicit grant: an allowlist of specific people, maintained separately from general admin permissions, that can be revoked instantly without touching anyone's admin role.

Every time someone outside the document's owner views a government ID, license, or tax form, it's written to an immutable log recording who, what, and when. Regular admins can't edit or delete those log entries; only the underlying system can.

Every data table in the system, including guard profiles, shifts, bookings, payments, licenses, and reviews, has explicit row-level security rules defining exactly who can read, create, update, or delete each record. A guard can only see their own booking history; an employer can only see applicants to their own shifts. This is enforced at the database layer, not just hidden in the app's interface.

If a submitted security license isn't approved, the uploaded photo or scan is deleted immediately, not retained indefinitely. If a guard fixes the issue and resubmits, they upload a fresh copy at that point. We only keep what we currently need.

All payment processing runs through Stripe, a PCI Level 1 certified processor, the highest tier of card-industry compliance. We never see or store a full card number, bank account number, or routing number on our own servers. Employer payments are held in escrow and released to guards only after a shift is completed and clocked out.

Guards are verified through their documents — we collect and review their government ID and security license during onboarding, and we make sure their license is active before they can book a shift. Every guard is vetted through our onboarding process before being approved to work on the platform.

Sensitive and easily-automated actions, including license verification lookups, document uploads, and document decryption requests, are rate-limited per user, so a compromised account or scripted attack can't be used to mass-extract data or hammer external systems.

Every notification email includes a link to granular preferences. You can opt out of specific categories, like shift reminders, payment notifications, or account alerts, individually, not just "unsubscribe from everything."