Security

Authentication and the database are provided by Google Firebase (Firebase Authentication and Cloud Firestore); the application is hosted on Vercel. Google Cloud encrypts data in transit (TLS) and at rest. Server-side actions that need elevated privileges run in isolated API routes authenticated by the caller's identity token.

Every read and write is checked by server-side security rules, so the boundaries hold even outside the app. Sensitive employee data is separated into protected collections:

• Public roster — name, role, positions — readable by teammates.
• Pay & HR — wage, hire date, contacts, birthday — readable only by the employee themselves and by managers.
• Manager-only — kiosk PINs and private notes — never readable by the employee they concern.

Joining a workspace is completed by a server-side check of the invite code, so a workspace cannot be joined by guessing an identifier.

Push notifications are sent through a server route that verifies the sender's membership and role before delivering. Location is captured only at a punch, only with device permission and when the business enables geofencing, and is used solely to flag off-site punches — never for continuous tracking.

We believe in being candid about a young product. On our roadmap: formal third-party security review, automated backups with documented recovery, audit logging of sensitive changes, and configurable data retention. If you have security questions or want to report an issue, contact us below.

Please email security@workforward.ca with details; we'll acknowledge and work with you on a fix. Update this address to a monitored inbox before launch.