Security

• Hosting in US regions (Vercel iad1; Neon Postgres US East).
• TLS everywhere; database encrypted at rest by the provider.
• Emergency-contact details encrypted in the application with AES-256-GCM using a per-company data key, wrapped by a master key held outside the database (cloud KMS planned).
• Contact details are never written to logs or the audit trail. Every view of contact details is logged.
• Roles: Admin, HR Staff, Auditor (read-only, no contact details). Two-factor (TOTP) for admins.
• Append-only, hash-chained audit log; database trigger blocks edits and deletes; integrity check on every export.
• PDF exports carry a SHA-256 content fingerprint.
• Health check at /api/health. Sends are idempotent with retries. Provider delivery webhooks are recorded in the audit chain.
• Downtime or data loss caused by our systems is our responsibility.