Security and privacy

You own your records: your OSHA 300, 300A and 301 logs, training records, JHAs, written programs and everything else you or your workers enter. We use them only as needed to run and improve 29Safety. We don't sell personal information.

Stripe handles every card payment. You type your card into Stripe's secure page, so card numbers go to Stripe and never touch our servers. We see only the card brand and the last four digits.

Your records and files are kept by Supabase, our database company, on servers in the United States. The website and app are hosted by Vercel. Your data is encrypted while it travels (HTTPS) and while it is stored.

Supabase makes a backup of the database every day.

A few other companies handle parts of your data to do one job, like making your Word and PDF files or sending email. Our Privacy Policy names each one and what it gets.

Each company's records are walled off from every other company's in the database itself. Every time someone asks for a record, the database checks which company they belong to and hands over only that company's records. This is called row-level security.

Any login can turn on two-step sign-in (a code from an authenticator app) under Settings, Password and two-step. Once it's on, the database won't hand over that person's records without the code.

The account owner can also require two-step sign-in for owners and admins, or for everyone with a login.

The 29Safety safety team sees what you send it: a question Harli hands over, a live chat, a booking, feedback, or a Harli answer you mark thumbs down.

Our owner tools show your company name, your plan, who has a login and their role, and how much your company uses Harli. Signing in to those tools takes a two-step code.

To look at anything else in your account, the safety team needs support access. Only an owner or admin can turn it on (under Help from the team). It shuts off after 24 hours or when you turn it off. With it, the team can look but can't change anything, and every view is logged in your account.

The people who run 29Safety's systems can also reach the database directly, to keep it running and fix problems.

If you cancel or a payment stops, your account locks, but nothing is deleted. For 90 days, the owner and admins can still sign in to pay, or to email themselves a complete copy of the company's records.

Before the account's data is deleted, we email the owner and admins a complete copy, and its download link works for 90 days. If the account never had a payment, the copy holds the records your company entered itself.

Keeping that copy is up to you: OSHA requires employers to keep the OSHA 300 log, the 300A summary and the 301 forms for 5 years (29 CFR 1904.33). The Terms of Service, sections 3.5 to 3.7, have the details.

Our Privacy Policy covers everything we collect, why, and how long we keep it. For anything else, email the 29Safety safety team.

safetyteam@29safety.comBook a free 15-minute call