1. Protecting data
- Encrypted in transit: every page and app connection uses HTTPS.
- Encrypted at rest: data and files are stored with our database provider, which encrypts them at rest.
- Hosted in the United States on established cloud providers. See Subprocessors.
2. Keeping companies apart
Every company’s information is separated by rules enforced inside the database itself, not just in the app. A manager of one company can’t reach another company’s data, and crew see only their own company’s hub.
3. Access inside your company
- Roles: owners, admins and managers on the manager site, each with set permissions.
- Leaders in the crew app get only the tools their position allows, for their department or everyone, as you set it.
- Private health information in paperwork is limited to owners and admins.
- Incident reports are seen only by owners, admins and positions you give incident access. Leaders who file a report see the ones they filed, and team members see only the statement they were asked for.
- Reviews are seen only by owners, admins and leaders with review access, for the people they lead. Only owners and admins approve a raise.
- Removed crew lose access automatically. When someone is no longer active, their crew hub signs out and stays locked.
4. Signing in
- Managers sign in with a password or a one-time code sent to their email.
- Crew sign in with their team member ID and birthday, plus a one-time email code the first time on a new device.
5. When Saucer looks at your account
Our team looks at a company’s account only when needed for support or to keep the Service running. That access is look-only by default, ends on its own after two hours, and every view is logged. If a change is needed, editing has to be unlocked for that session, and that’s logged too. Saucer’s own team has roles as well, so support staff can help you without being able to change billing or ownership.
6. Protecting account changes
- Owner of record and support PIN: the owner can save the company’s legal name, a phone number and a support PIN in Settings. Before Saucer changes who has access, who owns the account or billing because someone called or emailed, we check the request against these and call the owner back at the number on file.
- We can’t see your PIN, only check whether the one you give us matches, and every check is logged.
- “Was this you?” emails: the owner and admins get an email whenever someone is added, removed or given a new role, ownership changes, or the PIN or owner record changes.
- Only Saucer can transfer ownership, never an admin on your account, and an admin can’t remove the owner.
7. Backups
- Every night, Saucer backs up each company’s data and keeps the last five nights.
- Only the account owner can roll back, after typing the company name to confirm, so one admin can’t undo everyone’s work. Saucer saves a backup of right now before every restore, so a restore can be undone too.
- Deleted people go to a trash for 30 days, with their schedule, hours, paperwork and patches, and can be put back in one click.
8. Signed paperwork
For every signed document and incident statement, Saucer keeps the signed copy along with who signed, when, and the IP address and browser used, so you have a record if you ever need it.
9. Payments
When you pay for Saucer by card, the payment is handled by our payment processor. Saucer never sees or stores full card numbers.
10. Reporting a security issue
If you think you’ve found a security problem, please email support@getsaucer.com with details and steps to reproduce it. Please don’t access other people’s data or disrupt the Service while testing, and give us a reasonable chance to fix the issue before sharing it publicly. We appreciate it.