Privacy Policy

1. Who we are

SafetyCompass is operated by MilConnect Inc. ("MilConnect", "we", "us"). This policy covers the SafetyCompass website and service. Questions go to privacy@safetycompass.ai.

2. Our role, and your employer's

SafetyCompass is sold to organizations (each a "Customer"), such as an airport or a contractor, to keep their own safety and recordkeeping records. The Customer decides what records to keep about its employees, contractors and visitors, and why. For those records we act on the Customer's behalf and on its instructions, as its processor or service provider. We do not decide what is collected about workers, and we do not use those records for our own purposes.

If you are an employee whose information appears in a Customer's records (for example, on an OSHA injury and illness form), please direct requests to your employer. If you contact us instead, we will pass the request to the Customer and help it respond.

For the accounts of people who sign in, and for the security and operation of the service itself, MilConnect handles that information as described below.

3. Information in the service

• Account information: name, work email address, the organization and roles an administrator assigns, and sign-in security settings. Passwords and authenticator secrets are held by our identity provider (Amazon Cognito); we never store a password ourselves.
• Records a Customer enters: self-audits, findings and corrective actions, finding photos, incidents and investigations, hazard analyses and pre-task plans, the certification roadmap, company and department details, and hours worked and headcount used for safety rates.
• OSHA recordkeeping records, including the OSHA 300 Log, 300A Summary and 301 Incident Report. The 301 can include an employee's name, date of birth, home address, date hired, and the name of the treating physician and facility.
• An audit trail of each change to legally relevant records: who made it, when, and what changed. It is hash-chained so that later tampering is detectable.
• Technical information needed to run and protect the service, such as IP addresses, browser type and request logs kept by our hosting provider.

Access requests. Anyone can ask for access, or for help signing in, through the request form at https://safetycompass.ai/request-access. It collects a name, work email, organization, approximate number of seats and, optionally, a phone number, job title, site type and message. The request is emailed to MilConnect's setup team, together with the time it was sent and the requester's browser type, so that we can reply and set the organization up. It is not stored in the SafetyCompass database, and its contents are not written to our application logs.

4. How information is used

• To provide the service to the Customer: storing, displaying, calculating rates from, and exporting its records.
• To keep the service secure: authenticating users, enforcing multi-factor authentication, detecting and investigating misuse.
• To support Customers when they ask for help, and to meet our legal obligations.

We do not sell personal information, share it for cross-context behavioral advertising, or use Customer records to train machine-learning models.

5. Employee medical information

OSHA 301 personal and medical fields can be viewed or changed only by users the Customer has given the medical records permission, consistent with 29 CFR 1904.35. Being an owner or safety manager does not grant it. For privacy concern cases, the employee's name is withheld from users without that permission, as it is on the 300 Log under 1904.29(b)(6). These rules are enforced on our servers, not only in the screens.

This information is never sent to a connected app (see section 8).

6. Cookies and browser storage

SafetyCompass uses only cookies that are strictly necessary to sign you in and keep you signed in:

• a session cookie, which expires after one hour and is renewed while you work;
• a refresh cookie, which lets the session renew for up to eight hours;
• two short-lived cookies, lasting at most ten minutes, that carry a sign-in in progress between the password and authenticator steps.

All are HTTP-only, so page scripts cannot read them. We use no analytics, advertising or tracking cookies, and load no third-party tracking scripts.

The service does not keep a copy of your organization's records in your browser's storage, so records are not left behind on shared computers after you sign out. Older versions did; the current version deletes those copies when it loads.

7. Where information is kept, and how it is protected

• Records are stored with Amazon Web Services in the United States (US East, Ohio).
• Data is encrypted at rest with customer-managed encryption keys and in transit with TLS.
• Every user must enrol an authenticator app; sign-in requires a password of at least 12 characters and a one-time code.
• Each Customer's records are separated by row-level security in the database itself. The application connects with a restricted database role that cannot switch this off.
• Finding photos are stored in a private storage bucket, in a folder belonging to the Customer, and are served only to signed-in users of that Customer.
• Database backups are kept for 35 days. A monthly archive copy is written to locked storage that cannot be altered or deleted before its retention period ends.

No system is perfectly secure. If you believe you have found a vulnerability, please write to us at the address below.

8. Connected apps

A Customer's owner may connect another product to SafetyCompass, for example Meridian Helm, which offers AI-assisted features in connected apps. A connection is approved inside a signed-in SafetyCompass session, after multi-factor authentication.

• A connected app acts with the permissions the approving user has at the time of each request, never more.
• It can read summary safety information, audits, findings, corrective actions and incidents, and it can propose a limited set of changes (findings and incidents). It cannot delete records or change company setup.
• It never receives OSHA 301 personal or medical information, whatever the approving user's own permissions.
• Its changes are recorded in the audit trail under the app's name and the approving user.
• An owner can disconnect it at any time under Connected apps. Access tokens are stored only in hashed form.

Once information reaches a connected app, that app's provider handles it under its own terms and privacy policy.

9. Service providers

We use these providers to run the service:

• Amazon Web Services: hosting, database, file storage, encryption keys, user sign-in, account emails, and delivery of access requests to our setup team.
• Cloudflare: domain name service and, where enabled, network security for safetycompass.ai.

We will update this list before adding a provider that stores Customer records.

10. Retention

We keep a Customer's records for as long as it subscribes, unless it deletes them sooner.

OSHA requires employers to keep the 300 Log, 300A Summary and 301 forms for five years following the end of the calendar year they cover (29 CFR 1904.33). To support that, finding photos and evidence are kept for five years, and the monthly archive copies are locked for five years. Locked archive copies cannot be deleted early, by us or anyone else, and are deleted when their lock expires.

When a subscription ends, the Customer can export its records. We then delete its active records within 90 days, apart from the locked archive copies described above, and backups, which expire on their own 35-day cycle.

11. Access, correction, export and deletion

Customers can correct records in the service and export them at any time. A Customer administrator can ask us to export or delete its organization's data by writing to privacy@safetycompass.ai. Individuals should contact their employer, as explained in section 2. Some records cannot be deleted before the legal retention period ends.

12. Security incidents

If we confirm a security incident that affects a Customer's records, we will notify that Customer without undue delay, tell it what we know, and help it meet its own notification duties.

13. Children

SafetyCompass is a workplace service for organizations. It is not directed to children under 16, and we do not knowingly collect personal information directly from them.

14. Changes to this policy

We will post any change on this page with a new effective date. If a change is material, we will also tell Customer administrators before it takes effect.

15. Contact

MilConnect Inc. · privacy@safetycompass.ai