SECURITY

The security posture, stated plainly.

FloorCoach holds floor records that may end up in front of your customers and auditors. Here is exactly what protects them — and what certifications we do and don’t hold.

Row-level security on every organization-scoped table.

Data access is enforced at the database layer, per organization. Documents and records from one facility cannot leak into another’s queries or Coach answers — the Coach’s retrieval is site-scoped.

Tamper-evidence on signed records.

Each signed record carries a SHA-256 canonical hash. The audit pack’s Part 11 appendix recomputes every hash at compile time and marks any record invalid if it doesn’t match.

PIN-verified signing, sealed at rest.

Signing requires PIN verification; the PIN is sealed on-device with a non-extractable WebCrypto key.

Anti-extraction guard on the Coach.

The Coach carries a guard against prompt-based extraction of documents and corpus content.

Error monitoring in production.

What we don’t hold

FloorCoach does not currently hold a SOC 2 certification. We describe our posture rather than imply a certification we don’t have. We will complete your security questionnaire — ask.

SECURITY CONTACT

Harrison Royer, founder — hello@floorcoach.ai