Security & Compliance

Built for procurement. Ready for review.

Shift Copilot handles safety-critical operational data for Australian mining sites. Here's exactly how we protect it — and the documentation your procurement team needs.

Encrypted in transit and at rest

All data encrypted via TLS in transit. Database and file storage encrypted at rest. No unencrypted data at any point in the pipeline.

24-month report retention

Every handover report stored for a minimum of 24 months to support handover record-keeping obligations under the WHS (Mines) Regulations 2022 (WA) and equivalent state and territory mining frameworks.

Role-based access controls

Supervisors and site admins can access reports for their assigned site so incoming supervisors can receive outgoing handovers. No site can access another organisation's data. Access is revocable from the admin dashboard.

Local draft recovery

Typed or already-transcribed notes are periodically saved in the current browser. A connection and explicit retry are required to generate and save the official report.

No audio file stored by Shift Copilot

Speech recognition is supplied by the browser or device and may use its provider's online service. Shift Copilot receives and stores the resulting transcript, not an audio recording.

Your data, your operation

Data is never sold, shared with third parties for commercial purposes, or used to train AI models beyond generating your own reports. You own it. You can request export or deletion of your data at any time, and we action verified requests within 30 days (subject to regulatory retention requirements).

Data flow details

Voice input

Processed by the browser or device's speech-recognition service, which may operate locally or online. Shift Copilot receives the transcript. No audio file stored by Shift Copilot

Shift note text

Sent from browser to Vercel serverless function, forwarded to Anthropic API for structured report generation. TLS encrypted

Anthropic API

Shift notes processed by Anthropic (US-based) to generate reports. Standard commercial API retention may be up to 30 days unless separate terms have been agreed; API data is not used to train models by default. No model training by default

Generated reports

Stored in Neon Postgres database (AWS Sydney, ap-southeast-2). Retained for a minimum of 24 months to support handover record-keeping obligations. Accessible only to authorised users for your site. Encrypted at rest

Attached photos

Stored in Vercel Blob storage and served via a long, unguessable URL referenced only from your reports. Uploads require an authenticated session. Retained for 24 months alongside the report. Encrypted at rest

Authentication

Passwords hashed with bcrypt, never stored in plain text. Sessions use self-managed tokens held in our Neon database, expiring after 14 days and revocable instantly. No plain-text credentials

Infrastructure

Application hosted on Vercel. Database on Neon in AWS Sydney (ap-southeast-2), so account data and reports are stored in Australia. Shift notes are processed for report generation by Anthropic's US-based API; on-shore AI processing via AWS Bedrock (Sydney) is on the roadmap for customers requiring zero US processing.

Data sovereignty note: Account data and generated reports are stored in Australia (Neon, AWS Sydney ap-southeast-2). Shift notes are sent to Anthropic's US-based API for report generation. Under Anthropic's standard commercial API terms, inputs and outputs may be retained for up to 30 days and are not used to train models by default; different retention applies only where separately agreed. Customers who require AI processing to remain fully on-shore can contact us at jordan.deboer807@gmail.com — on-shore AI processing via AWS Bedrock (Sydney) is on our roadmap.

Australian regulatory coverage

Western Australia

Work Health and Safety (Mines) Regulations 2022 (WA) — Regulation 630 WorkSafe WA

New South Wales

Work Health and Safety (Mines and Petroleum Sites) Regulation 2022 (NSW) SafeWork NSW

Queensland

Mining and Quarrying Safety and Health Regulation 2017 (QLD) RSHQ

South Australia

Work Health and Safety (Mining and Petroleum Sites) Regulations 2014 (SA) SafeWork SA

Northern Territory

Work Health and Safety (Mining) National Uniform Legislation Regulations 2022 (NT) NT WorkSafe

Victoria

Mineral Resources (Sustainable Development) (Mineral Industries) Regulations 2019 (VIC) WorkSafe Victoria

Tasmania

Mines Work Health and Safety (Supplementary Requirements) Regulations 2025 (TAS) WorkSafe Tasmania

Procurement documentation

Full legal documentation available for procurement and IT security review.

Data Processing Agreement

Sub-processors, data subject rights, breach notification, audit rights. View DPA →

Service Level Agreement

99.5% uptime commitment, incident classification, response times, service credits. View SLA →

Data Retention Policy

24-month retention, deletion process, data export, regulatory basis. View Policy →