Security, Compliance & Trust

ShiftWatch is a cloud-based application supported by secure, scalable infrastructure and operational practices designed to promote the security, availability, and reliability of the service.

Yes. ShiftWatch uses encryption to protect customer data both in transit and at rest. Additional safeguards, including access controls and logical separation of customer data, are used to help protect information from unauthorized access or disclosure.

ShiftWatch uses role-based access controls to limit access based on a user's authorized responsibilities. Customers manage access for their users and assign appropriate roles and permissions based on their organizational and operational requirements.

Access to the supporting ShiftWatch environment by Timeguard personnel is restricted to authorized individuals with a legitimate business need.

Yes. ShiftWatch maintains audit and activity logging designed to support accountability, operational review, security monitoring, and investigation of reported issues.

Access to audit information is restricted based on authorized roles and responsibilities.

Timeguard maintains processes for identifying, evaluating, prioritizing, and addressing vulnerabilities that could affect ShiftWatch or its supporting environment.

Identified vulnerabilities are evaluated based on factors such as severity, potential impact, and risk, and appropriate remediation activities are tracked through resolution.

Changes to ShiftWatch are managed through documented development and change-management processes designed to support the security and stability of the production environment.

Changes are reviewed, tested, documented, and deployed through controlled processes before being introduced into the production environment.

Timeguard maintains operational practices designed to support the continued availability and recovery of ShiftWatch. These include system monitoring, backup and recovery processes, incident management, controlled maintenance, and business continuity and recovery planning.

Specific availability or service-level commitments may be established through applicable customer agreements.

Timeguard treats customer information processed through ShiftWatch as confidential and uses administrative, technical, and operational safeguards designed to protect it from unauthorized access, use, or disclosure.

Access to customer information is restricted to authorized personnel and service providers with a legitimate business need and appropriate confidentiality obligations. Customer information is also protected through measures including encryption and access controls.

Yes. Timeguard uses select third-party technology and service providers to support the operation and delivery of ShiftWatch. These relationships are managed through processes designed to address applicable security, confidentiality, availability, and operational risks. 

Additional information regarding relevant service providers may be available to authorized customers upon request.

Protecting ShiftWatch is a shared responsibility between Timeguard and its customers.

Customers are responsible for managing authorized users, assigning appropriate roles and permissions, protecting account credentials, securing customer-managed devices and networks, managing customer-controlled systems and integrations, and ensuring that information submitted to ShiftWatch is appropriate and authorized.

Customers should also promptly notify Timeguard of suspected compromised credentials, unauthorized access, security incidents, confidentiality concerns, or other events that could affect the security or availability of ShiftWatch.

Suspected security incidents, vulnerabilities, unauthorized access, confidentiality concerns, or other security-related issues involving ShiftWatch should be reported promptly to Timeguard using our Security Reporting Form.

When reporting an issue, please provide a description of the concern, when it was observed, the affected ShiftWatch feature or service, and relevant supporting information.

Please do not send passwords, authentication tokens, Social Security numbers, or other highly sensitive information through ordinary email.

Authorized customers may request additional ShiftWatch security and compliance information by contacting us via our Security Reporting Form

Depending on availability and applicable confidentiality requirements, documentation may include security policies or summaries, system information, business continuity information, compliance documentation, independent assurance reports, and other materials used to support customer security and risk assessments.

Certain information may require authentication, an applicable confidentiality agreement, or other authorization before it can be provided.

No. The SOC 2 examination and related compliance information described on this page apply specifically to ShiftWatch and the systems, infrastructure, processes, and services included within the defined ShiftWatch examination scope.

VisitWatch, TimeWatch, and other Timeguard products are not included in the ShiftWatch SOC 2 scope unless they are expressly identified as being included in applicable audit documentation.