Data & Security Summary

What Rota is

Rota is a web app (installable on phones) that residency programs use to publish call and shift schedules, handle swaps and time off, and generate schedules. It replaces the shared Excel file and the email chain around it. It holds workforce scheduling data only. It does not connect to the EHR and is not designed to hold patient information.

What data we store

No patient data, no Social Security numbers, no payment data, no medical records. Free-text fields show a reminder not to enter patient information, and the terms prohibit it.

Where it is stored

All customer data stays in the United States. The full subprocessor list is below.

Who can see what

Permissions are enforced inside the database with Postgres row-level security (RLS), so they apply even if someone bypasses the web app and calls the API directly.

Changes to requests go through database functions that check the caller's role, so a resident cannot approve a request or change someone else's shift. Every request change is logged with who did it, when and why.

Encryption

• In transit: HTTPS/TLS for all traffic between browsers, the app, the database and email provider.
• At rest: Supabase and Vercel state that customer data is encrypted at rest with AES-256; Resend states that its datastores are encrypted at rest. (See each provider's security page under Subprocessors.)

Sign-in

• One-time email links (passwordless, "magic link"). Links expire (Supabase default: 1 hour) and work once. Requests for links are rate-limited per address (3 per 10 minutes).
• People can only see a program if their email is on that program's roster. Chiefs invite their roster by email.
• Sessions use short-lived signed tokens (JWTs), refreshed automatically and stored in first-party browser cookies (SameSite=Lax) on an HTTPS-only site.
• Not yet available: SSO/SAML with the hospital's identity provider, and multi-factor authentication. Both are on the roadmap (see Gaps).

Calendar feeds

Each person can subscribe to their shifts in Apple, Google or Outlook calendars. The feed URL contains a random secret; it shows only that person's published shifts. The person can reset it at any time, which disables the old link.

Retention and deletion

• Data is kept while the Institution's agreement is active. The Institution can delete people, schedules and programs.
• At the end of the agreement: [30]-day export window, then deletion from production within [30] days.
• Sign-in rate-limit records are deleted after 1 day.
• Planned: an automatic retention job (for example, purging time-off reasons and notifications older than a set period).

Backups and availability

• Current status (pilot, free tier): no automatic daily database backups. We plan to move to Supabase Pro before real program data is loaded, which provides daily backups kept for 7 days, with optional point-in-time recovery.
• Hosting runs on Vercel's and Supabase's managed infrastructure. We do not yet offer an SLA.

Security practices

• Access to production systems is limited to the founding team, using accounts on the provider consoles.
• Secrets (API keys) live in the hosting provider's encrypted environment settings, never in source code.
• Server-to-server endpoints (solver, email webhook) require shared secrets checked in constant time.
• Code changes go through automated checks (lint, type checks, unit and end-to-end tests).
• We ran an internal security review of the code and database permissions in October 2026 and fixed the issues found.
• Not yet: SOC 2 report, independent penetration test, formal security training program. See Gaps.

HIPAA

Scheduling, time-off and swap records are workforce records, not patient records. They are generally not protected health information under HIPAA (see our HIPAA position memo). We ask users not to enter patient information and show that reminder next to every free-text field.

Incidents

We will notify the Institution of a security incident affecting its data without undue delay, and within [72] hours of confirming it. Security contact: [Security Email].

Subprocessors

Gaps we are working on

Daily backups (before real data), SSO/SAML, MFA for chiefs, audit log export, an automatic retention job, SOC 2 readiness, and an independent penetration test. Ask us for the current roadmap.

Contact

[Company Legal Name], [Address]. Security and privacy questions: [Contact Email].