How The Angel Squad Project looks after your data

What AngelSquad is

A professional network and workforce platform for infection preventionists and the healthcare people who work with them: community, facility organizations, a job board, education, chat and calls, scheduling and a policy register. It is not a patient-record system. Our terms prohibit posting patient information, members see a notice before their first chat message and first document upload in a facility, and reports of patient information are routed to our staff and to the facility at the highest priority.

Encryption

• Encrypted in transit: TLS 1.3 (1.2 minimum) for every web connection, and DTLS-SRTP for call audio and video.
• Encrypted at rest with AES-256: the encrypted disk volume that holds the database and every stored file, and every backup.
• Licence numbers, certification numbers and profile phone numbers are additionally encrypted field by field (AES-256-GCM) with keys that are never stored in the database or its backups.
• We use FIPS-approved algorithms (AES-256-GCM, SHA-256, TLS 1.2 and 1.3).
• We do not offer a scheme in which only the participants hold the keys. Our servers can read content so that we can honour legal holds, act on reports, produce exports and keep an audit trail — the controls healthcare organizations require of us.

Where your data lives

• United States only. All customer data, backups included, is stored and processed in US data centres, with backups replicated to a second US region.
• One customer, one deployment. Each customer runs on a dedicated deployment with its own database, storage and encryption keys. Nothing is shared between customers.

Calls

Calls are relayed by media servers we run ourselves. Your audio and video never reach a third-party conferencing or media provider, and calls are not stored.

Access and audit

• Every read is permission-checked in the database query itself, and a page that skips the check fails our build.
• Every AngelSquad staff account must use two-factor authentication before it can reach our administration console. Every member can turn it on, and a facility can require it of its own members.
• Our audit log is append-only at the database-permission level: the application cannot rewrite it.
• Staff have no screen for reading direct messages. A message is visible to staff only inside a report someone filed, and every such view is recorded.

Backups and recovery

Nightly encrypted backups are copied off the server to a second US region, with continuous database archiving designed to limit data loss to one hour, and a recovery target of one hour. Restores are rehearsed every week, and every rehearsal is logged with its date.

Retention and your data

• Chat and direct messages are kept for 365 days by default, and a facility can change that for its own channels.
• Legal holds suspend deletion of what they name.
• Every member can export their data and delete their account from their settings.
• We do not sell personal information, we do not run advertising, and there are no third-party advertising or analytics cookies.

Subprocessors

The companies that can receive any of your data, and exactly what they receive:

• DigitalOcean — hosting, storage and backups, United States regions. Sees data at rest, encrypted with keys we hold.
• Mailgun — email delivery. Receives your address, a subject and a message with no content: links, counts and identifiers, never message text, file names or document titles.
• Apple Push Notification service, Google Firebase Cloud Messaging, Mozilla Push Service and Microsoft Windows Push Notification Services — delivery of push notifications to your devices. They carry encrypted payloads whose contents are a notification type, identifiers and a count — never message text.
• Cloudflare Turnstile — the anti-bot check on guest job applications. Receives a challenge token and the requester's IP address.
• GitHub (and Google, where a deployment enables it) — sign-in, only if you choose it. They learn you are signing in to AngelSquad and send us your verified email address and name.
• JobDataAPI and TheNewsAPI — optional sources of public job listings and news headlines, off by default. They receive our search terms, never your data.

Not subprocessors: Garage, the file storage, and LiveKit and coturn, the call software, run on our own servers. ngrok is a testing tunnel that is never enabled on a deployment holding customer data. Error tracking: we use none — no third-party error tracking or telemetry service receives anything.

Business Associate Agreements

We do not currently sign Business Associate Agreements. Whether we will is an open decision for our owner, and until it is made — and our hosting provider's own agreement is in place — we do not accept data from covered entities that would require one. The platform is built to the HIPAA Security Rule's administrative and technical safeguards regardless, because state privacy laws and our customers expect those controls whether or not an agreement is signed. This page will change when the decision does.

Two roles, kept apart

For the community — your own profile, posts, connections and direct messages — AngelSquad is responsible for your data under our privacy notice. For a facility's workforce data — rosters, staff records, schedules, time off and the applications a facility receives — AngelSquad is the facility's service provider: we process it only to provide the service to that facility, and it never feeds the community directory, the feed or job matching.

Consumer health data

Washington residents, and anyone else who wants to know, can read our Consumer Health Data Privacy Policy.

Scheduling records

Shift and schedule data in AngelSquad is a scheduling record. It is not an auditable staffing record for CMS Payroll-Based Journal reporting: the operator's payroll system is that record, under 42 CFR 483.70(q). AngelSquad is also not built or sold for clinical alerting or mass notification, and a facility should not rely on it for either.

Security incidents

If a security incident affects your organization's data, we notify you within 72 hours of confirming it, and always within the time the law requires. Our incident response, contingency and risk documents are reviewed at least once a year.

Vulnerabilities

We fix security findings on a published timetable: Critical within 7 days, High within 30 days, Medium within 90 days. Every server image is rebuilt from its base at least monthly. Report a vulnerability through our security.txt contact; we acknowledge within one business day.

Continuity

AngelSquad is run by a single operator today. We are appointing a backup operator who will hold sealed emergency credentials, so that the service can be operated, restored or handed over if our primary operator is unavailable. Until that appointment is made, continuity depends on our primary operator, and our recovery procedures are written so that anyone holding those credentials can follow them.

Certifications and questionnaires

We do not hold a SOC 2 report, HITRUST certification or ISO 27001 certification today, and we do not claim to. A SOC 2 Type II examination is planned. We answer security questionnaires from a pre-answered SIG Lite that is kept in step with this page; ask through the help page.