Security & privacy
Isolated, least-privilege, auditable
Security in GuardTrack is not a feature you toggle — it is the structure every record sits inside. Here is what that actually means, without overclaiming.
Tenant isolation
Every record and file carries a tenant ID derived from authenticated membership — never an untrusted request field. Tenant A cannot read, update, or reference Tenant B's clients, guards, sites, conversations, or invoices through guessed IDs, search, nested relationships, realtime, or cached responses.
Least-privilege roles
Owners, admins, HR, supervisors, and guards each get the access they need — no more. Capabilities (manage_users, schedule, review_time, manage_billing, export_operational…) gate actions on top of roles. A guard never sees invoices, bill rates, earnings summaries, or another employee's private records.
Row-level security
Access is enforced at the database, server, storage, export, search, realtime, and analytics layers — not just where the UI happens to hide a button. A private bucket alone is insufficient without tenant and role policies.
Audit trail
Role changes, support access, punches, corrections, signatures, approvals, rate and PO changes, imports, exports, invoice revisions, and subscription changes are recorded where supported. Ordinary company users cannot edit audit records.
No silent data loss
Limits warn before they block. At a storage cap we keep the textual timekeeping and flag attachments as not saved. Downgrades block new premium operations but retain authorized historical read and export access. Failed payments keep your records — never silently erased.
Credentials & secrets
Service credentials and signing secrets live exclusively in managed Secrets — never in source, client bundles, or public errors. Sessions expire and can be revoked. We use least-privilege credentials and never expose stack traces, inmate information, or attachment links in public errors.
Data handling
What we keep, and how
Time records & signatures
Tenant-approved retention settings govern how long time, signature, and invoice records are kept. No universal statutory periods are invented.
Location evidence & selfies
Captured only at the punch with explicit permission. Retention is tenant-configurable; a failed optional photo never invalidates an accepted punch.
Messages & attachments
Tenant-isolated, membership-scoped, with extension/MIME validation, size limits, safe filenames, and download authorization. No executable or active HTML served inline.
Legal hold & deletion
Legal-hold controls and documented deletion/export workflows. Pending approval never triggers automatic destruction. Soft-deactivation preserves signed records and revokes access.
What GuardTrack is not
- › Not continuous tracking or route history. Location is captured only at the punch.
- › Not biometric identity verification. Optional selfies are not mandatory and use no face recognition or matching.
- › Not a cryptographically immutable ledger — it is a database with an audit trail.
- › Not a claim of HIPAA/CJIS compliance or agency approval. Tenant data-handling obligations are verified before any live sensitive import.
- › Not an uptime guarantee — that requires CWA approval.
Questions about our security model?
The CWA team can walk you through the architecture before you put a shift on it.