Your department's records stay your department's.
Pay rates, hire dates and time off are sensitive. Here's who can see them, how that's enforced, and what happens to the data when you leave.
Who can see what
| Who | What they can see and do |
|---|---|
| Member | The department's schedule, their own time off, overtime, calls, balances, and pay. Members can't see other members' pay or records. |
| Chief and co-admins | Their own department's people, schedule, approvals and payroll. Nothing from any other department. |
| Billing co-admin | Everything a co-admin can, plus the department's billing. |
| A member's Secondary Departments | Only that member. Your department's admins never see them. |
| Us (DeptFireShift Pro) | Each department has one DeptFireShift Support account, shown as such on your People page and never billed. It's a co-admin so we can help when you ask; it can't become Chief or manage billing, everything it does is in your audit log, and your Chief can turn it off and back on at any time. |
How it's enforced
In the database, not just the screen
Access rules are checked by the database on every request, so hiding a button is never the only thing in the way.
Admin mode asks again
Admin pages ask for your password again before department-wide changes, and lock again after 15 minutes.
Pay changes need approval
A member can't change their own department pay rate. Rate, step and stipend requests go to an admin, and self-approvals are flagged.
Approved pay periods lock
Once a timesheet is approved, its entries can't be edited or deleted without reopening it.
Audit log
Role changes, approvals, rate changes and removals are recorded with who did them and when.
Cards stay with Stripe
Card payments are handled by Stripe. We never see or store card numbers. Every connection uses HTTPS.
What happens to your data when you leave
Nothing is deleted just because a subscription ends. Your department's records stay yours.
- If the department's subscription ends
The department is locked and its data is kept. Restore billing any time and everything comes back as it was. Department admins can still sign in and download all of the department's data. To have it permanently deleted, contact us.
- If a member is removed
Their records stay with the department for payroll history. The Chief can choose to delete them, which happens after 60 days.
- If you delete your account
Sign-in stops right away. After 60 days your login and personal data are permanently deleted. Records you entered in a department stay with that department. How to delete your account
Services we rely on
- Supabase: database and sign-in
- Vercel: website hosting
- Stripe: card payments
- Resend: email delivery
- Anthropic: the AI assistant, only when someone uses it
- Tavily: web search for the AI assistant
Details are in our privacy policy.
Found a security problem?
Email us with the details and we'll look at it right away. Please don't test against other departments' data.
support@deptfireshiftpro.com