Security
How SHIFT protects your crews' hours, your payroll and your workers' personal data.
Last updated: 18 October 2026
SOC 2. SHIFT does not hold a SOC 2 report yet. We are preparing for a SOC 2 Type I audit scoped to the Security criteria, and we document our controls and policies to that standard. Our database provider, Supabase, holds a SOC 2 Type II report. On request, under NDA, we share our security policies, our control list and answers to your security questionnaire.
Where your data lives
In a PostgreSQL database run by Supabase on Amazon Web Services in the US East region. Everything is encrypted in transit (HTTPS) and at rest. Photos are kept in private storage that only your company's authorised users can open. The office pages are static files: they hold no data of their own.
Who can see it
- Your company only. Every row carries the company it belongs to, and the database itself refuses to show it to anyone else (row-level security). We test this automatically on every change.
- Only the pages you give. The owner decides which office pages each person opens. A worker sees only his own hours.
- No passwords to steal. Office users sign in with a one-time code sent to an email address the owner has allowed; workers' phones are bound to the person.
- A record of every change. Changes to who has access, pay rates, payroll and accounting settings, public-job rates and signed certified payrolls are written to an activity log with who made them, including any change made directly in the database. The owner sees it in Settings, and records a quarterly access review there.
Personal data we keep to a minimum
We never store full Social Security numbers, bank accounts, card numbers or passwords. For certified payroll only, we keep the last four digits of the SSN (or the date of birth), the home address and the facts the state's forms require; only the Payroll page shows them, and they are never copied into logs, emails or the activity log. Card payments are entered on Stripe's page, not ours.
Backups
Supabase backs up the database daily. Independently of it, every two hours the database is copied, encrypted with a key only we hold, to a second provider (Cloudflare R2); photographs and safety cards follow once a day. Every day one of those copies is downloaded back, decrypted and restored into an empty database, and its row counts are checked against the live ones; a failed check alerts us. Recent copies are locked against deletion — daily ones for 30 days, monthly ones for seven years. Besides that, every week each company's owner receives a full copy of their clock-ins, people, sites and hand corrections by email, as spreadsheets — a copy that does not depend on us.
Changes and testing
Every change is tested automatically — payroll arithmetic, overtime rules, the isolation between companies, the state's certified payroll schema — and every database change carries a written way back.
Companies we work with
| Company | What for |
|---|---|
| Supabase (on AWS) | database, sign-in, file storage, server functions |
| GitHub | source code, hosting of the office pages, and the job that makes the off-site copies |
| Cloudflare | the encrypted off-site copies of the database and the photographs |
| Stripe | subscriptions and payment |
| Resend | email: sign-in codes, alerts, the weekly copy |
| Anthropic | reading the text on a safety card photo, so the office does not type it |
| Expo, Apple, Google | building and distributing the phone app |
| Map and weather services | maps of your job sites on the office pages |
If something goes wrong
We follow a written incident procedure: contain, find out what was affected, tell the affected companies without unreasonable delay, and make the notices New York law requires.
Report a problem
If you think you have found a security issue, write to support@shiftbygekon.com with "Security" in the subject. We answer within two business days and do not take action against good-faith research.