SoarTime Pro Phase 1 — Data Isolation, Role-Based Access, Audit Logging, and Retention Lifecycle for Highly Sensitive staff information.
SSN, EIN, bank account, and routing numbers are stored in a dedicated UserSensitiveProfile entity, completely separate from User and StaffProfile.
Non-sensitive display surrogates (ssn_last4, bank_account_last4, bank_name_display) are the only values returned to the UI by default.
Plaintext HS fields never appear in any default API response — they require an explicit, audited reveal request that passes role and re-authentication checks server-side.
All checks are enforced server-side. Bypassing the UI (direct API calls) does not bypass the role matrix.
| Role | View Last4 | Reveal Plaintext | Edit HS Fields |
|---|---|---|---|
| STAFF (self) | |||
| STAFF (other) | — | — | — |
| COORDINATOR | — | — | — |
| SCHEDULER | — | — | — |
| PROGRAM MANAGER | — | — | — |
| HR | — | — | |
| FINANCE | — | — | |
| ADMIN | — | — | |
| SUPER ADMIN | — | — |
Phase 1 policy: only the user themselves can reveal their own plaintext. All privileged-role reveals are deferred to Phase 2 with break-glass tooling and stronger re-auth controls.
All reveal and edit operations require the user to confirm their account password before any plaintext is returned or written.
After a successful reveal, the plaintext is visible for 30 seconds then automatically masked — no manual dismiss required.
Phase 2 ticket P2-SEC-005: Replace with a dedicated credential-verify endpoint (no new session token issued), brute-force rate limiting, and biometric challenge option on mobile.
Every sensitive action writes an immutable row to SensitiveAccessAuditLog containing actor, target, agency, field name, IP, device, timestamp, and success/failure. Values are never logged.
Transfers are initiated only from the user's own account — never admin-initiated. SSN and bank consents are separate full-screen steps.
A signed CrossAgencyImportConsent record with per-field flags, IP, device, timestamp, and signature text is created before any data moves.
HS fields are re-written under a fresh destination row — never reference-shared across agencies. Source agency is logged on every export event.
| Class | Retention | Note |
|---|---|---|
| PAYROLL_TAX_RECORDS | 7 yrs | IRS / DOL requirement |
| EMPLOYMENT_RECORDS | 5 yrs | State labor law |
| OPERATIONAL_RECORDS | 2 yrs | Clock-in, geofence, daily tracker |
| SENSITIVE_PROFILE (HS plaintext) | 4 yrs | SSN / EIN / bank — purge on schedule |
Purge runs daily at 2 AM ET via a scheduled job. HS _value fields are set to null; _last4 surrogates and bank_name_display are retained for tax / audit compliance. Each purge writes an immutable PURGE audit row.
The following items require external infrastructure not available in Phase 1. Each is documented in SECURITY.md and tracked as Phase 2 tickets.
AES-256-GCM field-level encryption
Requires external KMS
DEK/KEK envelope encryption + rotation
Depends on P2-SEC-001
Cryptographic tokenization (vault-issued tokens)
Replace ssn_value storage
Tamper-proof signed audit logs
HMAC-signed / hash-chained entries
True re-auth challenge endpoint
No-token credential verify; brute-force protection
Server-side rate limiting on reveal endpoints
Redis-backed sliding window; anomaly alerting
HR / Admin / SuperAdmin break-glass reveal
Requires P2-SEC-005 + documented reason workflow
Biometric challenge (mobile)
Device / OS layer
Cryptographic erasure on purge
DEK destruction via KMS
Operational record bulk purge (2-year)
StaffLocationPing, ClockEvent, etc.
Source agency export notification
Email / webhook to agency admin on cross-agency transfer
Automated W-2/1099 workflow on termination
Tax document preparation integration