Security and your data

The GatherShift website and app run on Vercel. Your records, sign-ins and uploaded files are stored with Supabase. Both run on Amazon Web Services data centers. The full list of services we use, and what each one does, is in our Privacy Policy.

Everything between your browser or phone and GatherShift travels over an encrypted connection (HTTPS), and browsers are told to never connect without it. Your database and files are encrypted at rest by our hosting provider, and sensitive identification numbers get an extra layer of encryption on top.

Each agency's records are private to that agency. No other agency on GatherShift can see them. Staff see only their own records; admins see the people in their own agency. Uploaded documents sit in private storage and open through short-lived links, not public web addresses.

Agency admins have access to payroll, invoices and billing, so they confirm each new sign-in with a code sent to their email. Sign-in and form pages are rate-limited to slow down password guessing.

Card and bank payments are handled by Stripe. GatherShift never sees or stores full card numbers.

When a credential document is uploaded, an AI service (Anthropic) reads it to fill in details like the expiration date, so nobody has to type them. Under our agreement, Anthropic does not use your documents to train its models. What a document review by our team covers.

You can delete your agency's account from the Billing page. Staff records, credentials, documents, hiring, onboarding and messages are permanently deleted 14 days later. Shift, timesheet, invoice and payroll records are kept for six years because wage-and-hour, tax and Medicaid rules require them, then deleted. Details are in the Privacy Policy.

We're a young company and we want to be straight with you: GatherShift is not SOC 2 certified and has not had a HIPAA audit. GatherShift is built for workforce records (credentials, onboarding, schedules, timesheets and payroll), not patient medical records. A SOC 2 review is on our roadmap as we grow, and we'll update this page as that happens.

If a security problem affects your information, we'll tell you promptly so you can meet your own obligations, and notify regulators where the law requires. To report a security concern, email support@gathershift.com.