Security & readiness

Security and data protection.

What’s built into Scheduling Concepts today, what isn’t yet, and what happens before your agency’s real data goes in.

In place

Encrypted in transit and at rest
Every connection uses HTTPS, the application will not connect to its database without SSL, and stored data is encrypted by the database provider.
Audited US hosting
The application runs on Vercel and its database on Supabase in a US region. Both providers are independently audited for SOC 2 Type II; Vercel adds network-level DDoS protection.
Access based on responsibility
Role and unit permissions limit who can view and change records. Supervisor access follows the units an administrator assigns.
Individual accounts
Accounts are activated through time-limited, single-use invitations with protected passwords. Sign-in attempts are rate limited.
Authenticator sign-in
Optional authenticator-app verification with recovery codes is available to each user. Authenticator secrets are encrypted with their own key.
A durable record of decisions
Scheduling changes and approvals write to an audit log. Database protections prevent ordinary application access from editing or deleting audit and bank-history entries.

Our own independent assessment
An independent security assessment of Scheduling Concepts itself is still pending. The providers' SOC 2 audits cover their infrastructure, not our application.
Backups and recovery
Daily backups, operational monitoring and a tested restore come with the paid hosting plans an agency pilot will run on, and are verified before onboarding.
Single sign-on and agency-wide MFA
Single sign-on, emailed password recovery, and agency-wide mandatory MFA are not currently available.

Requirements first
We work through your agency’s security and deployment requirements before any real personnel data is used.
No certification claims of our own
Scheduling Concepts does not claim CJIS or SOC 2 certification. Standard hosting plans are not a CJIS environment; we discuss what your agency requires before any real data is used.
Fictional demos
Demonstrations use fictional records. You never need to share your roster to evaluate the product.

A live walkthrough of the software using a fictional police department and 911 center. No personnel data is needed.