Security and privacy
What Samwell does to protect the information of your staff, volunteers and donors. Facts, without jargon.
Who can get in
- Two-factor authentication required for every account, no exceptions: management, staff, volunteers and board
- Sign in with Face ID and fingerprint (passkey), or with a password or a code sent by email followed by the second factor
- Remote sign-out of your other devices, from your profile
- Lost phone? An authorized person in your organization resets your two-factor authentication, after confirming the request comes from you
Who sees what
- Each organization is isolated from the others in the database
- Everyone sees only what their role allows: permissions are checked by the database, not just on screen
- No one approves their own file: leave, a reimbursement or a role must be approved by someone else
- A volunteer sees their own schedule, never staff records
Where your data lives
- Database, files and authentication hosted in Canada (Supabase, ca-central-1 region, “Canada Central”)
- Service providers, what they process and where, are published in the list of service providers
Encryption
- Encryption in transit: HTTPS across the whole site, enforced in browsers (HSTS)
- Data encrypted at rest by the hosting provider
- Social insurance numbers and bank accounts encrypted separately in the database and shown masked; every reading of the full number is logged
Records no one can erase
- Audit log: who did what, and when
- No one can change or delete the log, not even management
- Every sign-in is recorded in the log
Law 25 and PIPEDA
- Person in charge of the protection of personal information, designated in the app by your organization
- Access requests tracked, with their 30-day deadline
- Register of confidentiality incidents
- Consents recorded in a register, with the version accepted
- Full export of the organization’s data at any time, and “My data” for each person
- Payroll and leave calculations are suggested, never imposed: your organization reviews and decides
What Samwell does not do
- No sale of personal information
- No advertising, no advertising cookies, no third-party analytics
- No use of your organization’s content to train artificial intelligence models
- No requests for sign-in codes or social insurance numbers by email
A question?
- Privacy and personal information: [email protected]
- Technical support, in English or French: [email protected]
See Samwell with your own scenarios
A 30-minute demo tailored to your organization and your province. No commitment.