Facility separation
Records are scoped to an organization and facility. Database policies prevent cross-tenant reads.
Security
Designed for separation, least privilege, and an audit trail.
This page describes how Shift Command is designed to protect operational data. Shift Command does not currently hold third-party security certifications; ask us about your requirements.
Roles & permissions
Planned roles
Authorization is enforced in server code and in database row-level security. Hiding a button is never the only control.
| Role | Intended access |
|---|---|
| Site Admin | Facility setup, users, integrations, and operating configuration |
| Operations Manager | Site-wide review and authorized operational decisions |
| Department Manager | Updates and review for assigned departments |
| Read Only | Permitted dashboards and reports |
Controls
How data is protected
Audit history
Significant changes record the actor, time, facility, action, related record, and before/after values.
Advisory by default
No automated staffing messages, worker moves, or extra-time offers. People approve actions.
Honest status
Stale or missing data is shown as such. Success is reported only after it is confirmed.
Credential handling
Secrets stay on the server.
- AI model calls and API keys are server-side only; browsers never receive them.
- Ingestion endpoints require per-source credentials that can be rotated or revoked.
- Data feeds are read-only by default.
- Demo requests submitted on this site are stored write-only: they cannot be read back through the public API.
RUN YOUR WAREHOUSE FROM ONE COMMAND CENTER
Bring your security questions.
We will walk through tenancy, roles, and data handling for your environment.