How your records are kept safe

ShelterBoard doesn't run its own servers. The app is hosted on Vercel, and the database, sign-in and photo storage are on Supabase, which runs on AWS. Both are audited annually against SOC 2 Type II and publish their reports. Email is sent through Resend.

Everything travels over an encrypted connection (HTTPS/TLS) — between your phone and the app, and between the app and its database. The database is encrypted on disk.

Every record belongs to exactly one shelter, and every request is checked against the signed-in person's shelter on the server before anything is read or written. That separation has its own automated tests, which run on every change. The database itself accepts no direct access: the only route to your shelter's records is through the app's server, which applies those checks every time.

Within a shelter there are three roles — volunteer, staff and admin — and the server enforces what each may do; hiding a button is never the only safeguard.

Dog photos are stored at public web addresses, the same way a photo on an adoption listing is. Nothing else is.

There is no public sign-up. An account exists only because one of your admins invited that person, and an admin can remove it at any time, which ends their access immediately.

Passwords are handled by Supabase Auth, which stores them only as salted hashes. We never see or store a password, and nobody at ShelterBoard can read one back to you.

Keys for the reporting API are created and revoked by your admins. We store only a fingerprint of each key, so it is shown once and can't be recovered — by you, by us, or by anyone who obtained a copy of the database.

Changes to dogs, outings, people and settings are written to an audit log with who made them and when. Outings and comments that an admin removes are hidden rather than erased, so the record can be reconstructed if it is ever in question.

ShelterBoard is built on open-source software, and new vulnerabilities in that software are published every week. We are notified automatically when one affects us, and every change to the app is checked against the public advisory database as it is made. That check also runs daily, so a newly published issue is caught even on a day when nothing else changes.

Our commitment: critical vulnerabilities are patched within 48 hours of a fix being available, high-severity ones within 7 days, and everything else in a routine weekly update.

On the web there is nothing for your shelter to install — a fix is live for everyone within minutes of release. On the iPhone app, updates arrive through the App Store, and smaller fixes can be delivered to the installed app directly. If a version of the app is ever unsafe to keep using, we can require the update: older versions stop working and ask to be updated, so nobody is left on a vulnerable copy without knowing it.

ShelterBoard is a small company, and access to the production systems is limited to its developer. We look at a shelter's data only to fix a problem you've reported or to keep the service running.

If we learn that your shelter's data was accessed by someone who shouldn't have had it, we will tell your shelter's admins within 72 hours of confirming it: what happened, what was affected, and what we've done about it.