Last updated July 13, 2026
This page summarizes the security practices currently reflected in the ShiftDispatch product and codebase. It is intended as a practical customer-facing overview, not a guarantee, certification, audit report, or service-level commitment.
If you have a security question or need additional contact information, email [email protected].
Security Contact
Please report suspected security issues to [email protected]. Include a description of the issue, affected URLs or accounts if known, reproduction steps if available, and any relevant screenshots or logs that do not expose unnecessary personal information.
Account And Session Security
ShiftDispatch uses signed, HTTP-only first-party cookies for account sessions, staff sessions, workspace multi-factor authentication challenges, and CSRF protection. Session cookies are configured with SameSite=Lax, use secure cookies in production, and are scoped to the relevant application paths where appropriate.
Authenticated workspace sessions and their successful privileged verification have a fixed lifetime of up to 30 days. Limited workspace onboarding sessions expire after one hour. Workspace admins can use phone-based verification for workspace multi-factor authentication flows. Staff access can use SMS one-time codes. Verification challenges are short-lived and expired or consumed challenges are pruned.
Password-based account access uses password hashing. Rate limiting is used for login, signup, waitlist, SMS, and other abuse-sensitive flows.
Data Protection
ShiftDispatch stores application data in a Render-hosted database. Data is organized around workspace and tenant boundaries. The application includes tenant-scoped queries and authorization checks for workspace, staff, schedule, chat, billing, notification, and invoice workflows.
Payment card details are processed directly by Stripe. ShiftDispatch stores Stripe customer, subscription, checkout, billing status, and related references, but does not store full payment card numbers or card security codes in the application database.
Google Drive/Docs invoice connector refresh tokens are stored encrypted. Connected account email addresses, scopes, file/folder IDs, and generated document URLs may be stored to provide invoice workflows.
Browser And Device Security
The application uses browser storage for product functionality, including free schedule builder drafts, public schedule publish metadata, PWA install preferences, push notification setup preferences, and staff confirmation prompt dismissals. Free schedule publish metadata may include management tokens used to unpublish or republish public schedule links, so those browser profiles and devices should be protected.
Public schedule links can be viewed by anyone with the link until they expire or are unpublished. Management tokens for public schedule links should be treated like private credentials.
Browser push notifications require browser permission and store push subscription endpoint/key material so notifications can be delivered.
Monitoring And Logging
ShiftDispatch uses application logging, rate-limit records, analytics, and error monitoring to operate and protect the Services. Sentry may receive scrubbed error and diagnostic metadata when error monitoring is enabled. The codebase includes scrubbers intended to filter obvious sensitive keys such as authorization, cookie, password, token, secret, OTP/code, phone, email, request body, payload JSON, invoice payload, endpoint, and push key fields from selected error contexts.
Analytics are used to understand product and website usage. The current PostHog browser configuration disables autocapture, pageleave capture, and session recording.
Retention
Active workspace and account data is generally retained while the account or workspace is active. Some core records are soft-deleted to preserve operational history and related records. Expired rate-limit records and short-lived verification challenges are removed by scheduled cleanup processes. Service logs, database recovery data, logical backup exports, error-monitoring data, and analytics data follow the retention settings of the applicable configured provider and service plan. Billing and invoice records may be retained as needed for tax, accounting, legal, and compliance purposes.
Free published schedule snapshots expire according to the product's configured publication period and are covered by cleanup jobs after expiration or unpublish. Free schedule builder drafts and publish metadata stored in browser local storage may remain until cleared by the user, browser, or application.
Customer Responsibilities
Customers and workspace admins are responsible for:
- Adding only workers, staff, phone numbers, addresses, schedules, invoice data, and operational information they are authorized to use.
- Obtaining any required consent for SMS verification codes and browser push notifications.
- Honoring legally required worker opt-outs, notification preferences, and requests not to receive verification codes, push notifications, or operational messages.
- Complying with employment, wage and hour, overtime, break, predictive scheduling, worker classification, recordkeeping, privacy, communications, and consent requirements that apply to their organization and workforce.
- Avoiding unnecessary confidential, sensitive, health, financial, or personal information in public schedule links, notes, messages, uploads, or invoice data.
- Protecting account credentials, devices, browsers, public schedule management tokens, and Google/Stripe/Twilio-related access they control.
- Promptly removing users or workers who should no longer have access.
Current Limitations
ShiftDispatch does not currently claim SOC 2, ISO 27001, HIPAA, PCI DSS, or similar compliance certifications. ShiftDispatch is not intended to store regulated health information, full payment card data, or other highly sensitive information unless a separate written agreement says otherwise.
No method of transmission or storage is guaranteed to be 100% secure. This page should be reviewed as the product, infrastructure, and customer requirements evolve.