Security & Data Handling

StayMap — IT Brief

The single-sign-on posture, session policy, and data-handling detail an IT security review asks for.

What It Does

StayMap is a nurse retention SaaS platform. It collects anonymous staff feedback (via QR code / link), maps responses to a validated 20-concept retention framework, generates heat maps showing where gaps exist, and guides managers through structured action planning with AI-assisted insights.

Three collection modes: guided funnel (structured taps), weekly pulse (emoji check-in), and AI stay interview (conversational). All data rolls up into the same anonymized framework — no individual staff identity is stored with responses.

Hosting & Infrastructure

HostingVercel — serverless, edge-deployed, SOC 2 Type II

DatabaseSupabase (PostgreSQL) — SOC 2 Type II, data encrypted at rest & in transit

RegionUS East (primary)

URLwww.staymaps.net

Uptime SLAVercel — 99.99% SLA on infrastructure

Authentication & Access Control

Auth providerSupabase Auth — industry-standard OAuth/JWT

Session handlingServer-side SSR sessions via HTTP-only cookies — no tokens in localStorage

SSO / SAML / SCIMNot implemented — roadmap item. Accounts are issued individually by administrator invitation and must be revoked manually when someone leaves.

Multi-factorNot enabled — email and password is currently the only factor. The underlying platform (Supabase) supports TOTP; StayMap does not yet expose enrollment.

OffboardingManual — an administrator removes the account. Without SCIM there is no automatic deprovisioning on termination.

Role-based access5 roles: Admin, CNO, Consultant, Unit Leader, Viewer — all data scoped by organization ID

Staff feedbackNo login required — anonymous token-based link, no PHI collected

Data & Privacy

PHI / PII storedNone — no names, employee IDs, job titles or exact tenure are stored anywhere, including on exit and stay interview records. The only staff email addresses that enter the system are pasted at send time to email a feedback link, and are discarded once the send completes.

What is storedFree-text feedback, concept classification, tenure band (optional), timestamp, cycle ID

Tenure bandCoarse bucket only (e.g. “0–90 days”) — never exact years, and not linked to any individual

Exit interviewsManager-entered notes and a transcript, recorded against a tenure band and date. No employee name, job title or years of service is stored — a job title plus exact tenure identifies one person on a unit even without a name.

Stay interviewsAI-facilitated. The transcript is stored with no name attached; a staff member could still identify themselves in free text, which the pre-interview notice warns about.

Flight riskMeasured for the unit, never for a person: the share of respondents who said they are considering leaving, withheld entirely below 8 respondents. StayMap does not compute or store per-person risk scores.

Data retentionRetained until organization requests deletion

Data exportCSV/PDF export available to Admin and CNO roles

HIPAANo clinical or patient data processed — not subject to HIPAA. Staff sentiment data only.

AI & Third-Party Services

AI providerAnthropic Claude API — all AI calls are server-side only, never exposed to the browser

What AI seesAnonymous feedback text only — no user identity, no org name sent to AI API

Anthropic data policyInputs are not used to train models (API usage terms)

Models usedClaude Sonnet 5 (classification, live interview), Claude Opus 4.8 (retention plans, flight-risk analysis, executive narratives)

EmailResend — transactional alerts to managers only

Rate limitingPer-instance request throttling on public feedback links — prevents spam submissions

Network / Firewall Requirements

Domains to whitelist

www.staymaps.net — main app

staymaps.net — redirects to www

staymap-app.vercel.app — Vercel fallback

ProtocolHTTPS only (TLS 1.2+)

Ports443 (HTTPS) only

Outbound from browserOnly to staymaps.net — all API calls (Anthropic, Supabase, Resend) are server-side

Security Posture

TransportTLS 1.2+ enforced, HSTS enabled

CSPContent Security Policy headers set — no inline scripts, no external script sources

Input sanitizationAll AI inputs sanitized server-side — prompt injection protection applied

SQL injectionProtected — Prisma ORM with parameterized queries only

Rate limitingPublic feedback endpoints throttled per IP (~10 req/min per instance) to prevent spam

Audit logAll admin actions logged with user ID, action type, timestamp, and changed values

Secret managementAll API keys stored as Vercel environment variables — not in code

Dependency scanningnpm audit on build pipeline

Known gaps, stated plainly

No single sign-on. SAML and SCIM are not implemented. Accounts are invited individually and revoked by hand, so a terminated employee retains access until an administrator acts.
No multi-factor enforcement. Password is the only factor today.
Rate limiting is per-instance. Public feedback throttling is in-memory, so limits apply per serverless instance rather than globally.
US data residency only. No EU or in-country hosting option.

Contact

Product ownerJack — jack@prinnovo.com

VendorPrinnovo