Security
The safest patient data is the data we never hold.
This page describes controls that are implemented today, in plain language. It is not a certification, and no page can prove the absence of all defects.
No patient information, by design
Shift schedules staff, not patients. There are no patient fields anywhere in the product — no names, no record numbers, no clinical detail. The riskiest category of healthcare data is absent structurally, not filtered.
Workspace isolation at the database
Every table is protected by row-level security scoped to your workspace. One department's roster, schedule, and requests are invisible to every other workspace — enforced by the database itself, not just the application.
Sign-in and sessions
Authentication runs on Supabase Auth over TLS. Sessions are cookie-based and every request re-checks membership; removing someone from the workspace cuts their access on their very next request.
Roles that mean something
Owners and managers configure and publish; techs see their own schedule, volunteer, swap, and request time off. Write paths check the role on the server — hiding a button is never the security boundary.
Revocable feed tokens
Calendar feeds and the OrderFlow roster import use long, unguessable per-scope tokens. Each serves the minimum data its purpose needs, and disabling or regenerating a token kills the old link immediately.
Governed change, not silent change
Schedule-affecting actions record who did them. The draft engine proposes and a human decides — nothing publishes a schedule, books a person, or changes coverage on its own.
What this is not
- Shift holds no protected health information, so a BAA is not required to use it. If your organization prefers one as policy, raise it during procurement.
- We do not hold SOC 2, HITRUST, or ISO certifications and do not imply otherwise. Ask us anything specific — you will get a direct answer about what is and is not in place.
- Staff names, credentials, and work schedules are still workforce data and are treated with the isolation and access controls described above.
Security questions during procurement: info@axiomeeg.com