Security & Data Handling

StayMap — IT Brief

The single-sign-on posture, session policy, and data-handling detail an IT security review asks for.

What It Does

StayMap is a nurse retention SaaS platform. It collects anonymous staff feedback (via QR code / link), maps responses to a validated 21-concept retention framework, generates heat maps showing where gaps exist, and guides managers through structured action planning with AI-assisted insights.

Three collection modes: guided funnel (structured taps), weekly pulse (emoji check-in), and AI stay interview (conversational). All data rolls up into the same anonymized framework — no individual staff identity is stored with responses.

Hosting & Infrastructure

HostingVercel — serverless, edge-deployed, SOC 2 Type II

DatabaseSupabase (PostgreSQL) — SOC 2 Type II, data encrypted at rest & in transit

RegionUS East (primary)

URLwww.staymaps.net

Uptime SLAVercel — 99.99% SLA on infrastructure

Authentication & Access Control

Auth providerSupabase Auth — industry-standard OAuth/JWT

Session handlingServer-side SSR sessions via HTTP-only cookies — no tokens in localStorage

SSO / SAML / SCIMNot implemented — roadmap item. Accounts are issued individually by administrator invitation and must be revoked manually when someone leaves.

Multi-factorNot enabled — email and password is currently the only factor. The underlying platform (Supabase) supports TOTP; StayMap does not yet expose enrollment.

OffboardingManual — an administrator removes the account. Without SCIM there is no automatic deprovisioning on termination.

Role-based access5 roles: Admin, CNO, Consultant, Unit Leader, Viewer — all data scoped by organization ID

Staff feedbackNo login required — anonymous token-based link, no PHI collected

Data & Privacy

PHI / PII storedNone — staff responses are fully anonymous. No names, employee IDs, or personal identifiers stored with feedback.

What is storedFree-text feedback, concept classification, tenure group (optional), timestamp, cycle ID

Tenure groupCoarse bucket only (e.g. “Less than 3 months”) — not linked to any individual

Stay interviewsAI-facilitated, anonymous transcript stored — no employee name attached unless voluntarily shared in text

Data retentionRetained until organization requests deletion

Data exportCSV/PDF export available to Admin and CNO roles

HIPAANo clinical or patient data processed — not subject to HIPAA. Staff sentiment data only.

AI & Third-Party Services

AI providerAnthropic Claude API — all AI calls are server-side only, never exposed to the browser

What AI seesAnonymous feedback text only — no user identity, no org name sent to AI API

Anthropic data policyInputs are not used to train models (API usage terms)

Models usedClaude Sonnet 5 (classification, live interview), Claude Opus 4.8 (retention plans, flight-risk analysis, executive narratives)

EmailResend — transactional alerts to managers only

Rate limitingPer-instance request throttling on public feedback links — prevents spam submissions

Network / Firewall Requirements

Domains to whitelist

www.staymaps.net — main app

staymaps.net — redirects to www

staymap-app.vercel.app — Vercel fallback

ProtocolHTTPS only (TLS 1.2+)

Ports443 (HTTPS) only

Outbound from browserOnly to staymaps.net — all API calls (Anthropic, Supabase, Resend) are server-side

Security Posture

TransportTLS 1.2+ enforced, HSTS enabled

CSPContent Security Policy headers set — no inline scripts, no external script sources

Input sanitizationAll AI inputs sanitized server-side — prompt injection protection applied

SQL injectionProtected — Prisma ORM with parameterized queries only

Rate limitingPublic feedback endpoints throttled per IP (~10 req/min per instance) to prevent spam

Audit logAll admin actions logged with user ID, action type, timestamp, and changed values

Secret managementAll API keys stored as Vercel environment variables — not in code

Dependency scanningnpm audit on build pipeline

Known gaps, stated plainly

No single sign-on. SAML and SCIM are not implemented. Accounts are invited individually and revoked by hand, so a terminated employee retains access until an administrator acts.
No multi-factor enforcement. Password is the only factor today.
Rate limiting is per-instance. Public feedback throttling is in-memory, so limits apply per serverless instance rather than globally.
US data residency only. No EU or in-country hosting option.

Contact

Product ownerJack — jack@prinnovo.com

VendorPrinnovo