Security at Just Say When

Written for the IT reviewer with a questionnaire in hand. Short version: we schedule staff, not patients — there is no PHI in the system by design — and every tenant boundary is enforced in the database itself, not just the interface.

No patient data, by design

Just Say When stores workforce scheduling data only: staff names, work emails, roles, shifts, and time-off. It has no fields for, and no reason to hold, patient information. Our terms prohibit entering patient data anywhere in the system, including free-text notes. Because no protected health information is stored, the system does not process PHI in the HIPAA sense — and we intend to keep it that way.

Tenant isolation

Every row of data is scoped to a hospital and unit, enforced with PostgreSQL row-level security — the database itself refuses cross-tenant reads and writes, independent of application code. Managers reach only the units they manage; employees see their own unit's published schedule and their own requests. These policies are exercised in an automated multi-role test harness.

Access control & accounts

• Three roles — admin, manager, employee — with least-privilege scoping per unit.
• No public signup. Accounts are provisioned during onboarding; the only self-serve surface is a throwaway sandbox with fictional data.
• Password reset uses emailed one-time codes (designed to survive hospital email link-scanners); no links to click, nothing to intercept.
• Deprovisioning is immediate: archiving an employee cuts their sign-in in the same operation. Sessions are individually revocable.

Encryption & infrastructure

All traffic is encrypted in transit (TLS). Data at rest lives in a managed PostgreSQL database (Supabase, on AWS us-east-1) with provider-level encryption at rest. The web application is served by Vercel; all API secrets are server-side only and never reach the browser.

Audit trail

Database-level triggers record who changed what, and when — including before/after values — across the core scheduling and staffing tables. The audit log is written by the database, so it can't be skipped by application bugs.

Backups

Automated daily backups with rolling retention, plus manual snapshots taken before any schema change. Schedules and hours are also exportable to Excel/CSV by your own managers at any time — your data is never locked in.

Security reviews

A full-stack internal security review (database policies, API surface, and frontend) was completed in July 2026; all critical findings were remediated before this page was published. We have not yet undergone an independent SOC 2 audit — we're honest about that, and it's on the roadmap as the product grows.

Reporting a vulnerability

Email brantb@justsaywhen.app. You'll get a response from the person who builds the product, not a ticket queue.