Security Overview

This is a plain-language description of the current pilot, not a certification, guarantee, or substitute for your own vendor review.

Infrastructure and transport

The production service runs on Cloudflare Workers and Cloudflare-managed storage.
The public site and app are served over HTTPS.
The crew app does not accept or store payment-card data directly.

Board access model

Crew boards do not use a conventional username/password account. The admin recovery key is a high-entropy bearer secret: the raw key is stored in the admin’s browser, while the server stores a SHA-256 hash for verification. Worker links contain a separate high-entropy token. The worker token is stored with the board so an authorized admin can retrieve the link again.

Practical consequence: anyone who obtains an admin key can administer that board, and anyone who obtains a worker link can record events for that worker. Send links individually, do not post them publicly, and permanently delete a board if its access links are no longer trusted.

Input and export protections

Server inputs are length-limited and normalized before storage.
Board creation and event endpoints are rate limited.
Admin actions require the recovery key.
CSV cells that begin with spreadsheet-formula characters are prefixed before export to reduce formula-injection risk.
The worker page returns only that worker’s own member record and recent events, not the whole roster.

Location and background access

The crew check-in page does not request GPS, microphone, camera, contacts, or background permissions. A future location feature should not be inferred from older marketing copy; it is not part of the current crew data flow.

Known limitations

No SOC 2, ISO 27001, or other third-party security certification is claimed.
No paid third-party penetration test is claimed.
The pilot has no email account recovery, enterprise single sign-on, role hierarchy, audit-log immutability, or customer-managed encryption key.
Cloudflare KV is an eventually consistent store; the board is designed for lightweight operational visibility, not safety-critical or transaction-critical coordination.
A dedicated public vulnerability-intake address is not yet published. That is a launch gap, not something this page hides behind generic “contact support” language.

Deletion

An authorized admin can permanently delete the board from the admin screen. This invalidates its crew links and removes the application record. Provider backups and security logs may age out on provider schedules rather than instantly.

Appropriate use

Do not use CheckInForWork as an emergency-response system, a clinical or protected-health-information system, a certified-payroll system, or the only control for work where a missed check-in could signal imminent danger.