Authentication
- Email and password authentication is handled by our managed authentication service.
- Optional Google sign-in via OAuth 2.0.
- Signed access tokens and refresh sessions protect signed-in requests.
- Password resets require email verification.
Data isolation
User-facing personal and organisation data uses row-level security and server-side permission checks. Access is scoped to the signed-in person, their Circle role, a named responder role, or an organisation role, depending on the record.
Encryption
- In transit: encrypted HTTPS connections.
- At rest: managed storage encryption.
- Secrets: service keys live in encrypted server environments, never in client code.
Location data
CheckOn records location only for a location feature you use: an attached CheckOn, a temporary live share, a place reminder, or SOS. Live sharing requests updated positions while its visible timer is active; it is not an open-ended movement history.
Continuity
Our managed hosting provider maintains service recovery and backup controls. CheckOn is not a guaranteed-uptime emergency service, so keep another way to reach people or emergency services.
Vendor security
We use specialist providers for hosting, push notifications, email, and payments. We limit each provider to the information needed for its job and review provider security and data terms.
Responsible disclosure
Found a vulnerability? Email security@checkon.appwith details and a proof-of-concept. We review valid reports and may offer a reward at our discretion. Please avoid accessing other people's data and give us a reasonable chance to investigate.
Your role
- Use a unique, strong password (or a password manager).
- Keep your email account secure — it's the recovery path.
- Review the people in your circles regularly.