Security & Data Protection Policy

SafetyOrient is a software platform for workforce orientation, credential management, and recordkeeping. SafetyOrient is not a safety consulting service, competent person service, training provider, regulatory compliance provider, or workplace safety manager.

The responsibility for OSHA compliance, workplace safety, worker supervision, and regulatory adherence remains solely with the employer, contractor, superintendent, and project management team utilizing the Service.

SafetyOrient is committed to protecting the confidentiality, integrity, and availability of information entrusted to the platform by subscribing companies, administrators, project personnel, and workers.

This Security & Data Protection Policy describes the measures SafetyOrient uses to safeguard personal information, worker records, project data, certifications, orientation records, uploaded documents, and other information maintained within the Service.

SafetyOrient recognizes the importance of protecting sensitive workforce and business information and strives to implement commercially reasonable administrative, technical, and physical safeguards designed to reduce security risks and support the secure operation of the platform.

While no system can guarantee absolute security, SafetyOrient continuously works to improve its security practices, monitor potential threats, and maintain a secure environment for its users.

The following categories of data are collected and stored on the platform:

• Worker Records — name, company, trade, contact information, and project assignment
• Credentials & Certifications — OSHA cards, trade licenses, driver's licenses, and other uploaded documents
• Orientation Data — completed orientation steps, rule acknowledgments (initials), and completion timestamps
• Project Data — project details, safety rules, site hazards, and configuration settings
• Company Settings — branding, emergency contacts, and global safety configurations
• User Accounts — names, email addresses, and roles of platform administrators
• Demo Requests — contact information submitted via the request demo form

• All data is transmitted over encrypted HTTPS connections (TLS 1.2+)
• Uploaded files (credentials, licenses) are stored in secure, access-controlled cloud storage
• Worker and project data is access-controlled at the record level — users can only access their own company's data
• Administrative access requires password authentication in addition to account login
• Database records are logically isolated per company account
• Platform infrastructure is hosted on enterprise-grade cloud services with industry-standard security certifications

Subscribing companies own their data. Upon request or account termination:

• A full data export (worker records, projects, certifications) can be requested within 30 days of account closure
• After 30 days post-termination, data may be permanently deleted from our systems
• Individual worker records can be deleted at any time by a company administrator
• Uploaded credential files can be removed on a per-file basis

To request a data export or deletion, contact us at the email below.

SafetyOrient uses the following third-party services that may process data on our behalf:

• Base44 — application hosting and database infrastructure
• Resend — transactional email delivery (demo request notifications)

All third-party processors are bound by data processing agreements and handle data only as instructed by SafetyOrient.

• Only authenticated administrators within a company account can view worker records and credentials
• Workers access only their own orientation flow and credential status via QR link
• SafetyOrient staff do not access customer data except when required for technical support, and only with customer consent

SafetyOrient maintains periodic system backups designed to support business continuity and disaster recovery. While commercially reasonable efforts are made to preserve customer data, SafetyOrient does not guarantee that data loss will never occur.

In the event of a confirmed security incident affecting customer information, SafetyOrient will make commercially reasonable efforts to notify affected customers without unreasonable delay and in accordance with applicable laws.

Multi-factor authentication may be available for administrator accounts and is strongly recommended where supported.

Data is stored and processed within the United States unless otherwise disclosed.

SafetyOrient is intended for business and workforce management purposes and is not directed toward individuals under the age of 18.

This policy may be updated as our practices evolve or as required by law. Subscribing companies will be notified of material changes via email. Continued use of the platform after notification constitutes acceptance of the updated policy.

For data protection inquiries, deletion requests, or data export requests, contact: