Security

1. Hosting and encryption

Safirst ONE runs on managed infrastructure in the United States (AWS, US West).

All traffic is encrypted in transit with TLS, and the web console enforces HTTPS. Data at rest is encrypted by the hosting platform (AES-256). Our hosting providers hold SOC 2 Type II.

2. Access control

Every organization’s data is isolated by access policies enforced inside the database itself, on every query. A user can see only records that belong to their organization, or that an administrator has explicitly assigned to them. Because the rule lives in the database rather than in application code, a bug in a screen or an integration cannot widen what a user can see.

Those policies are covered by an automated regression suite that signs in as each role and checks what it can and cannot reach. It runs on every change to the data layer, and a failure blocks the change from shipping.

3. Identity and roles

Sign-in is by Apple, Google, or email and password. Sessions are short-lived and refreshed securely, and sign-in endpoints are rate-limited.

Each user holds one role, from worker through safety administrator, and an organization assigns roles to its own people. Safirst staff roles are separate and cannot be granted from any organization-facing screen or join code.

4. Files and shared links

Photos, reports, certificates, and documents are stored in private storage. No file has a public address, and access is decided by the same policies that protect the record it belongs to.

When a report is emailed to a distribution list, the link is signed and time-limited: it opens one specific file, it cannot be altered or guessed, and it stops working when it expires. Like any emailed attachment, it can be opened by whoever holds the email during that window. Organizations that prefer sign-in-required delivery, or a shorter window, can have either enabled.

5. Record integrity and audit trail

Compliance records cannot be quietly altered after the fact. Once an inspection is filed, its findings, photos, and responses are frozen. Filed documents cannot be deleted or replaced; the only permitted change is archiving. Each generated report is stored with a cryptographic fingerprint of its contents, so a regenerated report never overwrites an earlier one.

An audit log records who did what, to which record, and when, including submissions, approvals, report delivery, role changes, exports, and account deletions. It is append-only: it cannot be edited or deleted, and it is never purged. Organization administrators can export it.

Training records are enforced server-side. A quiz unlocks only after the server has confirmed the required share of the course video was watched, quiz attempts are recorded by the server, and certificates are generated by the platform rather than uploaded by users.

6. Change control and monitoring

• Every change is reviewed and passes automated checks, including the access-policy regression suite, before it can ship.
• Changes reach a staging environment first. Production releases are a separate, deliberate step that requires a typed confirmation and is recorded.
• Secrets are kept in a managed secrets store, never in source code.
• Production is monitored continuously. Errors alert the engineering team within seconds, a health monitor runs every few minutes, and the monitors are themselves watched by independent alarms.
• The production database is backed up automatically every day.

7. Data retention and deletion

Inspection, training, and compliance records are retained for the life of the account and for the periods regulators require; nothing is auto-deleted. A person can delete their account from within the app or from our website. That removes their personal details and disables their login, while the records they produced remain intact under their organization, as a compliance record requires.

Customer data is never sold or shared for advertising.

8. Sub-processors and AI

Customer data is shared with a small number of service providers, each for a single purpose. The principal ones are listed below; the complete list is available on request.

AI is used narrowly. Two optional features, off by default and enabled per organization, use a language model to draft prose: written safety plans and the narrative of client reports. The model is never given worker names, credentials, photos, or documents, and it never produces a number: every figure is computed by the platform. The OSHA recordkeeping module (300, 300A, 301) uses no AI anywhere. Our AI providers do not train on submitted data.

9. Questions

Security is a fit between a system and your requirements. Send us yours, or your standard questionnaire, at team@safirst.com, and we will walk your team through how Safirst ONE meets them.