Security overview
Last updated: October 20, 2026
The short version
- Private check-ins are encrypted before they are stored and never appear on any manager or leadership screen.
- Every request is checked against the person's role on our server. The database can't be reached from a browser.
- Group figures are shown only for five or more people, and survey answers are never shown with names.
- Check-in text and survey answers are never sent to an AI service.
- We haven't completed a SOC 2 audit or independent penetration test yet, and we'll tell you plainly what we do and don't have.
How data is protected
In transit
All traffic to the app, the API and this website uses HTTPS (TLS).
Private check-ins
Encrypted by our server before they reach the database (Fernet: AES-128 with an HMAC-SHA256 integrity check, key derived with PBKDF2-HMAC-SHA256). The key is kept out of the database. If it's ever missing, private check-ins are refused rather than stored unprotected.
At rest
The database is hosted by Supabase in the United States, on storage our provider encrypts at rest.
Integration tokens
If an organization connects Slack or monday.com, the access tokens are encrypted the same way as private check-ins.
Who can see what
- Sign-in: handled by Clerk. Each request to our API carries a signed token (RS256) that we verify against Clerk's published keys. Requests without a valid token are refused.
- Role-based access: employee, manager, director and CEO/HR roles are checked on the server for every request. Managers see only check-ins their own direct reports chose to share. Leaders see aggregates.
- No direct database access: row-level security blocks all browser access to the database; only our API, with a server-side key, can read it.
- Roles come from the organization: people get their role and manager from their organization's invite links or team list, never from what a browser sends. Only the organization's administrator can change roles.
- Deactivation is immediate: a deactivated account loses access on its next request.
- Our own access: access to production systems and the encryption key is limited to SafeVoice Daily's system administrator. We don't use it to read private entries.
Anonymity safeguards
- Minimum group of five: participation rates and survey results are only shown when at least five people are behind the number.
- Surveys: each person can answer once. Answers are stored linked to the account only to enforce that, are never shown with names, and typed answers are shuffled so their order can't be matched to who submitted when.
- Private stays private: private check-ins get no topic label and aren't counted in any theme or dashboard.
- AI features: leadership nudges receive counts and percentages only; survey suggestions receive only the topic a leader types. Under Anthropic's commercial terms, that data isn't used to train models.
- Notifications: emails and Slack messages never include check-in text.
Accountability
- Activity log: role and manager changes, deactivations, invite links, surveys sent, settings and integration changes are recorded with who did them and when. The organization's administrator can review it in the app.
- Deletion: when an organization cancels, we delete its check-ins, surveys, accounts and logs within 30 days, children first, with a tool that reports exactly what was removed. An organization can also ask us to delete a former employee's data.
- Export: organizations can request an export of their data.
- Abuse protection: the demo request form is rate-limited and screened for bots; AI features are limited to leaders and capped per hour.
Service providers
| Provider | What they do |
|---|---|
| Supabase | Database hosting (United States) |
| Railway | Application server (API) |
| Vercel | Web app hosting |
| Clerk | Sign-in and authentication |
| Resend | Email delivery |
| Anthropic | AI nudges and survey suggestions (no check-in or survey content) |
| HostGator | This marketing website |
Where we are today
SafeVoice Daily is a young product, and we'd rather be clear than impressive:
- We have not yet completed a SOC 2 audit or a third-party penetration test.
- Single sign-on (SSO/SAML) is planned but not available yet.
- We're happy to complete your security questionnaire, sign a data processing agreement, and walk your IT team through any of the above.
Schools and public agencies
SafeVoice Daily is for adult staff. We don't collect student records or student information, and staff are asked not to include student or client details in check-ins.
Report a security issue
If you think you've found a vulnerability, email larry@andreslabs.com with "Security" in the subject line. Please don't test against other organizations' data. We'll acknowledge your report and keep you updated. If we learn of an incident that affects personal information, we notify affected customers as the law requires.