Built on real access controls, not just a login screen.
ZeroBadge handles GPS location and workforce data for a reason — it has to be trustworthy by construction, not just by policy.
Tenant isolation at the database layer
Every table is protected by row-level security policies in Postgres, not just application-level permission checks. A query from one organization's session cannot return another organization's rows — even if the application code had a bug, the database itself refuses the read.
Encryption in transit and at rest
Data is encrypted in transit (TLS) between the badge, the platform, and the dashboard, and encrypted at rest in the database. Each physical badge authenticates with its own unique device certificate rather than a shared credential.
Audit logging on sensitive reads
Every read of location and timesheet data by a dashboard user is logged with who accessed it and when — so location data access is itself auditable, not just the data.
Role-based access control
Access is scoped by role — a site supervisor sees only their assigned jobsites, a worker sees only their own records, and billing/settings/team-management screens are restricted to office administrators. Superadmin access (used only for platform operations) is a separate, explicitly gated role.
Defined data retention, not indefinite storage
Detailed GPS location tied to timesheet records is automatically purged after 90 days. Underlying shift records are retained for up to 3 years to support payroll and audit needs, then become eligible for deletion. Deleting a worker or jobsite archives it with a limited restore window before permanent removal.
Scoped credentials, least privilege
Internal service credentials are split by privilege — for example, the credential used to send commands to badges is narrowly scoped to only that one action, separate from broader administrative access. No customer-facing feature holds more access than it needs.
Have a security questionnaire or specific compliance requirement?