01
Dedicated environment
Customer deployments are designed to use separate application and data environments, helping reduce cross-customer exposure and simplifying customer-specific access and offboarding.
Security & data protection
Security should be understandable before it is impressive.
TeamWorkt Safety is building a practical security program around isolated customer deployments, controlled access, secure cloud infrastructure, defined production-hardening checks, and transparent communication about what is in place today and what remains on our roadmap.
TeamWorkt Safety itself is not currently SOC 2 audited or ISO/IEC 27001 certified. We do not present our cloud providers' certifications as our own.
Our deployment model
Designed to reduce unnecessary shared risk.
TeamWorkt Safety is built for smaller employers that want a focused safety workflow without putting every customer into one large shared application environment. Each production customer deployment is designed to have its own application environment, data project, authentication configuration, storage policies, deployment settings, and secrets.
Security controls are verified during customer implementation.
Before a production customer goes live, the deployment is reviewed against a defined hardening checklist covering authorization, storage access, secrets, encrypted connections, backups, logging, account lifecycle, and export/deletion procedures.
Pre-go-live standard
Core security approach
The controls we build around each customer deployment.
02
Least-privilege access
Production hardening includes role-based application access, database row-level authorization, private storage where appropriate, and explicit policies for who can read or change records.
03
Encrypted connections
Customer-facing traffic is served over HTTPS/TLS. The planned Supabase platform automatically enforces SSL for its HTTP APIs, with database SSL enforcement available as an additional production control.
04
Administrative protection
Our security standard requires protected infrastructure accounts, unique credentials, multi-factor authentication for administrative services, and server-side handling of privileged secrets.
05
Backups & recovery
Customer production setup includes a defined backup and recovery approach appropriate to the deployment, plus restoration testing before recovery promises are made contractually.
06
Account lifecycle
Customer onboarding includes defined invitation, role-change, suspension, offboarding, and administrator-recovery procedures so access can be removed when a person's responsibilities change.
07
Data lifecycle
Retention, customer export, deletion, legal holds, and attachment handling are defined by record type, applicable requirements, and the customer agreement rather than one blanket retention period.
08
Security review
Before customer launch, TeamWorkt reviews authorization behavior, storage permissions, exposed secrets, authentication, logging, backup readiness, and common abuse cases.
09
Customer identity options
Where appropriate, customer deployments can be configured around the customer's identity environment, including supported Microsoft, Google, OAuth/OIDC, or SAML-based sign-in patterns.
Security & compliance roadmap
Building the program before claiming the badge.
Our cybersecurity program is being organized around the NIST Cybersecurity Framework 2.0: Govern, Identify, Protect, Detect, Respond, and Recover. We are also developing our information security program toward alignment with ISO/IEC 27001, with formal certification included in the longer-term assurance roadmap as the business grows.
We will not describe TeamWorkt Safety as SOC 2 compliant, SOC 2 certified, ISO/IEC 27001 certified, or HIPAA compliant unless and until the applicable work and independent assurance actually support that statement.
Transparency
What this page does and does not promise.
This page describes TeamWorkt Safety's security approach and the production standards we use or are establishing for customer implementations. Final controls can depend on the customer's selected hosting, identity, retention, and contractual requirements. Detailed security discussions can be covered during scheduled evaluations and onboarding.
Last updated: September 26, 2026. Security claims are reviewed as the product, providers, and assurance program change.