Security at The StaffApp™

The StaffApp™ · Effective Date: April 15, 2026 · Last Updated: April 17, 2026

1. How We Think About Security

The StaffApp™ is trusted with information that matters: your staff’s performance records, your managers’ notes, the audit trail you’d want in your corner if a termination ever got challenged. We take that trust seriously, and we build the platform with the assumption that security is a prerequisite, not a feature.

This page describes, in plain language, the security measures and practices we have in place. It’s written for operators who want to understand what we do, for IT and security teams evaluating the platform, and for anyone who wants to kick the tires before signing up.

If you have questions this page doesn’t answer, or you need information for a security review, reach out to security@thestaffdevapp.com and we’ll help.

2. Infrastructure and Hosting

The Service runs on modern, well-regarded cloud infrastructure:

• Application hosting: Vercel (global edge network, automatic HTTPS, DDoS protection at the network layer)
• Database and authentication: Supabase (Postgres database with row-level security, SOC 2 Type II attested)
• AI model provider: Anthropic (enterprise-grade API with contractual commitments not to train on submitted data)
• Speech-to-text: Deepgram (voice dictation; zero-retention configuration; audio never stored)
• Text-to-speech: ElevenLabs (DevCoach Listen feature; licensed custom voice model of Chef Adam M. Lamb; standard operational log retention, not used for model training on our plan tier)
• Email delivery: Resend (SOC 2 Type II)

All of these providers maintain their own security certifications and practices. We’ve selected them specifically because their security posture meets or exceeds what we could build ourselves at our current scale.

A complete list of the third-party services that process Customer Data is maintained at https://thestaffdevapp.com/legal/subprocessors/.

3. Data Protection

Encryption

• In transit: All connections to and from the Service use TLS 1.2 or higher. This applies to the application, the API, and every subprocessor connection.
• At rest: All Customer Data is encrypted using AES-256 or equivalent, managed through our cloud providers’ key management services.

Data Isolation

Every Customer Organization’s data is logically isolated from every other customer’s data through row-level security at the database layer. A customer cannot see or access another customer’s records through any interface. This is enforced at the database level, not just in application code, so it holds even if an application-level bug were ever introduced.

Voice Dictation

Voice dictation is available on all subscription tiers. Because voice data invites specific privacy questions, here’s exactly what happens when a manager uses the Dictate feature:

1. Audio is captured in the browser over an encrypted connection
2. Audio is forwarded to our Edge Function and then to Deepgram under zero-retention configuration
3. Deepgram transcribes the audio and returns text
4. The audio is discarded from memory; it is never written to disk on our servers
5. Only the transcribed text, inserted into the field where the user dictated, is retained

The audio itself exists in memory for the seconds it takes to transcribe. That’s it.

4. Access Control

For You and Your Team

• Role-based access within the Service (owner, GM, department head, manager, and staff-level permissions)
• Strong password requirements
• Multi-factor authentication available for all accounts
• Session management and automatic timeout on inactive sessions

For Our Team

• Access to production systems is restricted to personnel with demonstrated business need
• Multi-factor authentication required for all production access
• All production access is logged for audit
• Personnel access is revoked immediately upon role change or departure
• The principle of least privilege governs all internal access decisions

5. Application Security

• Source code maintained in version-controlled repositories with access restrictions
• Automated dependency scanning with prompt patching of known vulnerabilities
• Security-relevant changes reviewed before deployment to production
• Separate development, staging, and production environments
• Rate limiting applied to authentication and API endpoints to prevent abuse
• Web application firewall protections at the edge

6. Backups and Recovery

• Automated database backups performed continuously by our database provider
• Point-in-time recovery capability
• Documented disaster recovery procedures
• Regular restoration testing to verify backups work as expected

In the event of a significant incident affecting availability, we prioritize restoring service quickly and communicating transparently with affected customers.

7. Incident Response

We maintain documented procedures for responding to security incidents, including:

• Detection and triage of potential incidents
• Containment and remediation
• Customer notification in accordance with our Data Processing Agreement (within 72 hours of a confirmed breach affecting customer data)
• Post-incident review and process improvement

Notifications of security incidents affecting your organization’s data will come from security@thestaffdevapp.com to your Account Owner.

8. Compliance and Privacy

The StaffApp™ is designed to help customers meet their obligations under:

• GDPR and UK GDPR — we offer a Data Processing Agreement aligned with Article 28 requirements, including Standard Contractual Clauses for international data transfers
• CCPA/CPRA — we operate as a Service Provider, with contractual commitments not to sell or share personal information
• State privacy laws — including Virginia, Colorado, Connecticut, Utah, and others

Our full Privacy Policy is available at https://thestaffdevapp.com/legal/privacy-policy/, and our Data Processing Agreement is available on request at support@thestaffdevapp.com.

9. Third-Party Certifications

The StaffApp™ is operated by Chef Life Media LLC, which does not currently hold SOC 2 or ISO 27001 certifications. We plan to pursue SOC 2 Type I attestation within our first year of general availability, followed by Type II.

Our underlying infrastructure providers do hold certifications relevant to the security of the Service:

• Supabase: SOC 2 Type II, HIPAA available on enterprise plans
• Vercel: SOC 2 Type II, ISO 27001
• Resend: SOC 2 Type II
• Anthropic: SOC 2 Type II
• Deepgram: SOC 2 Type II, HIPAA
• ElevenLabs: SOC 2 Type 2, ISO 27001:2022, ISO 27018:2019, ISO 27701:2019, ISO/IEC 42001:2023 (AI management systems), PCI DSS 4.0.1 Level 1, HIPAA, GDPR, CCPA/CPRA, EU AI Act-aligned
• Stripe: PCI DSS Level 1, SOC 1/2 Type II

10. Responsible Disclosure

If you discover a security vulnerability in The StaffApp™, please help us keep our customers safe by reporting it responsibly to security@thestaffdevapp.com.

What we commit to:

• We will acknowledge receipt of your report within 3 business days
• We will investigate and keep you informed of progress
• We will not pursue legal action against researchers who act in good faith, follow responsible disclosure practices, and do not access or modify customer data beyond what’s necessary to demonstrate the vulnerability
• We will credit researchers (if desired) for responsibly disclosed vulnerabilities

What we ask:

• Report the vulnerability privately before public disclosure
• Give us reasonable time to remediate before disclosing
• Do not access, modify, or exfiltrate customer data
• Do not perform testing that degrades service for other users
• Do not use social engineering, phishing, or physical attacks

We do not currently offer monetary bug bounties but plan to as the platform matures.

11. Your Role in Security

Security is a shared responsibility. Here’s what we ask of you:

• Use strong, unique passwords and enable multi-factor authentication on your account
• Manage user access responsibly — grant the minimum access each team member needs, and deactivate accounts for departing staff immediately
• Be thoughtful about what you enter — the Service stores what you tell it to store; sensitive information that doesn’t belong in employment records shouldn’t be added in the first place
• Report suspicious activity to security@thestaffdevapp.com as soon as you notice it
• Keep your browser updated — modern browsers ship security patches regularly

12. Changes to This Page

We’ll update this page as our security practices evolve, as we add new certifications, or as we adopt new technical measures. Material changes will be reflected in the “Last Updated” date at the top.