Security
Who can sign in, what they can see, and a record of what changed.
The controls your IT and compliance teams ask about, built into the app your nurses and managers already use.
Signing in
Single sign-on (SAML 2.0)
Staff sign in with your identity provider: Microsoft Entra ID, Okta, Ping, ADFS or any SAML 2.0 provider. Responses must be signed with your certificate. You can require SSO for your email domains, which turns off password sign-in for them.
Two-factor login
Anyone can add a code from an authenticator app after their password, with ten one-time recovery codes stored only as hashes. Wrong codes are limited. On the Health system plan you can require it for hospital admins and unit managers.
Passwords
Stored with Argon2 hashing, never in readable form, and checked against common and too-short passwords.
People and permissions
SCIM 2.0 provisioning
Your identity provider or HR system creates people, updates their name, employee number and unit, and turns them off when they leave.
Role-based permissions
Hospital admin, staffing office, unit manager, charge nurse, educator, HR (read-only) and staff each see and change only what their role allows. Unit managers and charge nurses are limited to their own units.
Required credentials
Set the licenses and certifications each unit needs. Nurses missing one, or whose card expires before the shift, cannot pick up, be approved for or swap into that shift.
Records
Audit log
Approvals, schedule changes, role changes, settings, exports, sign-ins with SSO and two-factor changes are recorded with who, when and from which IP address. Filter it and download it as CSV.
Your data, exportable
Download payroll, reports and the audit log as CSV, or read units, staff, shifts, time off and timesheets through the API.
Integrations
API keys stored hashed
Keys are shown once when created and only a SHA-256 hash is kept. Each key is read-only or read-and-write, and can be revoked.
Signed webhooks
Every webhook is an HTTPS POST signed with HMAC-SHA256 over a timestamp and the body, so your systems can verify it came from us and reject replays. Webhooks to private network addresses are refused.
Hosting
HTTPS everywhere
All traffic is encrypted with TLS. Plain HTTP is redirected, browsers are told to use HTTPS only (HSTS), and session cookies are sent over HTTPS only.
Security reviews and agreements
Contact us about our security documentation and BAA, or send us your security questionnaire.