Security & Data Use

Every workforce record carries the identifier of the organization that owns it, and access rules are enforced in the database rather than only in the interface. A request that is not a member of an organization returns nothing for that organization, even if the identifier is guessed. Within an organization, role determines reach: employees see their own records, managers see the departments or locations assigned to them, and HR-restricted categories require an explicit permission grant.

Credential and employment documents are stored in a private bucket with no public URLs. A download is possible only through a short-lived link generated for an already-authorized, signed-in request. Uploads are size limited, recorded with the uploader and timestamp, and can be traced in the audit log.

Sensitive actions — credential verification, document upload, personnel record changes, access grants, invitation acceptance, schedule overrides — write an append-only audit event. Audit events cannot be edited or deleted through the product, by any role.

• Supabase — managed Postgres database, authentication, and private file storage.
• Cloudflare — application hosting, TLS termination, and edge delivery.
• Stripe — subscription billing and the customer billing portal. Card data stays with Stripe.
• Resend — transactional and notification email delivery.
• RingCentral — SMS delivery and inbound STOP/HELP handling.

Each provider receives only the data needed for its function. We will update this list before adding a provider that handles workforce data.

• Encrypt traffic in transit with HTTPS and strict transport security.
• Keep organization data segregated by database-level access rules, not by interface filtering alone.
• Hold uploaded documents in private storage with time-limited, authorized access only.
• Keep payment credentials out of our systems entirely.
• Verify inbound billing webhooks by signature and reject anything unsigned.
• Require a shared secret on scheduled and integration endpoints.
• Maintain an append-only audit trail of sensitive actions.

• Use strong, unique passwords and do not share accounts.
• Grant owner, admin, and HR permissions only to people who need them, and review that list periodically.
• Remove access the day someone leaves, and complete the offboarding checklist.
• Decide what belongs in the platform. Keep patient information out of it.
• Tell your staff what is tracked and why, as your local employment law requires.
• Export anything you are required to retain independently before closing an account.

If we become aware of a security incident affecting your organization's data, we will investigate, contain, and notify the organization owner on record with what we know and what we are doing, without waiting for the investigation to be complete.

Organization admins can export workforce, timesheet, and payroll data as CSV from the reporting screens at any time. A full workspace export or deletion is handled through your account representative so we can confirm the request comes from an authorized owner.

Questions about this page, your organization's data, or a deletion or export request should go to your Tjane Health account representative, or through the support channel listed for your organization at tjanehealth.com. Requests are handled through the account owner on record so we can confirm authorization before releasing or removing workforce data.