Security
A badge system holds names, faces and ID numbers. We build like it.
Security features are not an upsell here. Two-factor authentication, the audit log and fine-grained permissions are on every plan.
Sign-in
The front door. Strong by default on every plan.
Two-factor authentication
Authenticator app, passkey or security key, or an emailed code. Recovery codes are shown once and stored hashed.
Required where it matters
Anyone who can manage users, export or delete records or manage printers must enroll before they can use the app. New organizations start with 2FA required for everyone.
Confirm again for sensitive actions
Exporting a dataset, deleting all records and changing who owns the organization each ask for your second factor again.
Passwords
At least 12 characters, checked against known breached passwords, and stored only as a salted hash.
Sessions
Sessions time out after 8 idle hours by default. See your signed-in devices and sign out of any of them.
Access control
Most badge-office mistakes are someone being able to do more than they needed to.
Nine permissions
Printing, record editing, export, delete-all, design, datasets, reports, printers and user management are granted separately.
Per-dataset access
Limit a user to the datasets they work with, such as one building or visitors only.
Audit log
Every change, import, export, print and sign-in is logged with who and when, and the log is searchable.
Organization controls
Lock two-factor authentication on for everyone in the organization, and set how long a session may sit idle before it ends. Both are on every plan.
Your data
Names, photos and ID numbers, kept apart from every other customer's.
Isolated per organization
Every query is scoped to your organization in application code and again by database row-level security. An automated test suite tries to cross that line on every endpoint, on every release.
Encrypted
TLS in transit, encrypted at rest. Your browser never talks to the photo storage at all: the app reads each image, checks you are allowed to see it, and sends it on. The bucket has no public path, and cannot be given one.
Stored in the United States
Hosted on Google Cloud in one US region. Nothing is replicated abroad.
Backed up
Daily database backups with point-in-time recovery, over a seven-day window. Deleted or overwritten files are recoverable from storage for seven days. Restores are made to a clone, never onto production, and the first rehearsal is scheduled before there is customer data to lose.
Payments
Card details go straight to Stripe. They never touch our servers.
Yours to take or delete
Export any dataset to CSV at any time, and ask for a complete export with photos and templates whenever you want one. After cancellation, data is kept 90 days and then deleted. Ask, and we delete it sooner.
Schools
Student records need more care, and districts need paperwork. We're ready for both.
FERPA
We act as a school official with a legitimate educational interest, under your direct control, and use student data only to provide the service.
Student data privacy agreements
We sign the national student data privacy agreement (SDPC NDPA) or your district's own, on any plan. Write to sales.
No student accounts
Staff use Badgewright; students don't. No child signs in or gives us information directly.
No face recognition
Cropping, including the optional centre-on-face helper, runs entirely in your browser; what reaches us is the cropped photograph. We don't create, store or match biometric identifiers, and we never compare a face against anything.
What we don't have yet
We don't hold a SOC 2 report. If your procurement process needs a security questionnaire filled in, send it and we'll answer it in full.
Report a vulnerability
Found a security problem? Write to security@badgewright.com with the steps to reproduce it. A person reads every report. Please don't access other customers' data while testing.