Privacy and security
Your records, kept apart. Your team's health answers, private.
What is kept, who can see it, and what is not promised yet.
Start your 25 days free What is not promised yet
25 days free. Cancel anytime.
The plain list
Who sees
which answer?
The answers are stored. Only the manager screens and the inspection binder leave them out.
| Who | What they see |
|---|---|
| You, the worker | Your own answers, and your own result |
| Manager or person in charge | Only what to do: OK to work, or No food work today |
| The inspection binder | Each check-in's outcome, never the answers |
What about where I am?
Arrival keeps a verdict,
never a place.
The arrival log keeps only whether someone is at the shop or not. It never keeps where anyone is.
- The record says at the shop, or not.
- No coordinates are saved with it.
- A place with no map point set never asks the phone where it is.
What about my records?
Each business
is kept apart.
- Each business's records are kept apart from every other business.
- Your role (Owner, Admin, Manager or Staff) decides what each person can do.
- Changes to records, people, permissions and setup are written down: who changed what, and when. Owners and managers can read that list on the Prove tab.
- Sign-ins are on it too: when, who, and how (email code, Google or the tablet PIN). It keeps only the first three parts of the network address, never the whole one.
- Phone numbers, codes and PINs are hidden in that list, and health answers stay out of it. Setup lines say which setting changed, never what it was set to.
- A mistake is marked as not done after all. The original stays.
- Each binder download is written down too.
Owners and managers can filter the list to Sign-ins or Setup changes.
Who can get in?
No passwords
to remember.
- Sign in with a 6-digit code sent to your email. Some places also see Sign in with Google.
- The code is random and kept only in scrambled (hashed) form, so the real code is not on file. It lasts 10 minutes and allows 5 tries.
- One email can ask for 5 codes an hour.
- You stay signed in for 30 days of use. The sign-in is kept in scrambled (hashed) form.
- On the shop tablet, each person's 4-digit PIN is stored scrambled (hashed) too. Five wrong tries lock it for 15 minutes, and easy PINs like 1111 and 1234 are refused.
Is it locked up?
Encrypted disk.
HTTPS everywhere.
- Your records are stored on an encrypted disk.
- Every CleanCleaver address uses HTTPS. A plain http address is sent on to https.
- Between the app and its database, data stays on a private network.
- Sign-in codes, sign-ins and PINs are stored scrambled (hashed), so the real code or PIN is not on file.
What about photos, voice and my card?
Photos stay yours.
Card numbers never reach us.
- Photos you take are stored under your business's own path in a private bucket. They are never public and are shown only to its members. A restart or a new version of the app does not lose them.
- Voice notes:
Uses your phone's speech recognition. We never keep the recording, only the words you save.
- Card numbers are typed only on Stripe's pages and never touch our servers. Checkout and the billing portal are both Stripe's pages.
- Only an owner or admin can see billing.
See the inspection binder these records build, on sample data.
What is not promised yet
What is not
promised yet.
- Health answers. They are stored. Only the manager screens hide them.
- Your data. You can download the binder as a PDF and the team and arrival lists as spreadsheets.
- Taking it all out. There is no tool yet to download or delete everything a business has stored.
- Who at CleanCleaver can see stored data. Not published yet. Ask by phone.
- Lost phone. A sign-in ends after 30 days. There is no button yet to end it sooner, so call.
- Photos. They are kept in a private bucket at Tigris. We have not confirmed in writing how Tigris protects stored files, so we make no promise about it yet.
- The database link. It stays on a private network. It is not wrapped in a second layer of encryption.
- Security badges. No SOC 2 report yet. Our security controls are written down and ready for an audit when a customer needs one. We make no HIPAA claim.
- Outside testing. No outside team has tested the app for weak spots.
- Uptime and backups. No uptime promise and no service agreement. The database is backed up every day and kept 5 days. A restore has not been tested.
- The paper health sheet. Please do not photograph a filled one.
If your question is not answered here, a person will answer it.
What if I find a problem?
Found a weak spot?
Tell a person.
Call or text. Say what you saw and on which screen. Our security.txt file (at /.well-known/security.txt) lists the same ways to reach us.
Rules for reporting:
- Test only with an account of your own, and never read, change or keep another business's records.
- Do not slow the service down, send spam, or trick our people.
- Give us a fair time to fix it before you tell anyone else.
- If you follow these rules in good faith, we will not take legal action against you for the report.
Who runs the service for us, and what each company gets: the subprocessor list. How we handle your data: the privacy policy.
Ready?
Answer plainly.
Know what is kept.
Your binder is ready when the inspector is. Start with one shift.
25 days free. Cancel anytime.
Want the price first? See pricing.
You have seen what is kept and what is not. The first check-in is the fastest way to see it live.
Questions
Before you
start.
Can my manager see my health answers?
No. The manager and the person in charge see only what to do today, like No food work today. The answers are stored, and the manager screens and the inspection binder leave them out.
Do you track where my staff are?
No. The arrival log keeps only whether someone is at the shop or not, never where they are.
Can another business see my records?
No. Each business's records are kept apart from every other business. Changes to records, people, permissions, setup and sign-ins are written down with who and when.
Do you have a SOC 2 report? What about HIPAA?
No SOC 2 report yet. Our security controls are written down and ready for an audit when a customer needs one. We make no HIPAA claim. Ask by phone and a person will answer plainly.
Are my records encrypted?
Your records are stored on an encrypted disk, and every CleanCleaver address uses HTTPS. Sign-in codes, sign-ins and PINs are stored scrambled. Photos are the exception for now: they sit on the app's own disk, not the encrypted one.
Can I take my records with me or have them removed?
You can download the inspection binder as a PDF, and the team and arrival lists as spreadsheets. There is no tool yet to download or delete everything a business has stored. See What is not promised yet above.
What happens if a phone is lost?
A sign-in ends after 30 days. There is no button yet to end it sooner, so call us. On the shop tablet, five wrong PIN tries lock that PIN for 15 minutes.
Your binder is ready when the inspector is.
Pick your place. Start with one shift.
Start your 25 days free See it work
25 days free. Cancel anytime.
Questions? Call or text (415) 640-1667