You are handing us your organization’s emergency plan. Here is how we treat it.
This page is written to be read by a board member, not a security engineer. Everything below is a practice we actually follow, described plainly — and where something is a limitation rather than a feature, we say that too.
Encrypted in transit and at rest
Every connection is TLS with HSTS enforced at the edge. Database volumes are encrypted at rest, and backups carry the same encryption as the live data.
Role-based access, scoped by organization
Every query is scoped to your organization from the signed session, never from anything a browser sends. Administrators, staff, and volunteers see different things, and anything that spends money or places a call requires an administrator.
Credentials handled properly
Passwords are hashed, never stored or logged in the clear. Sessions are signed JWTs with a short life. Invitations expire.
The smallest roster that works
We store names, ICS seats, and contact details for the people on your response team — usually a few dozen. We do not import your student information system, your HR directory, your patient records, or your church management software, and we have no interest in your payroll or your membership roll.
An audit trail on the things that matter
Plan approvals, roster changes, incident declarations, and every outbound call are logged with who, what, and when. That record is as much for your protection as ours.
Isolated infrastructure
The application runs as a non-root container behind Traefik with security headers and rate limiting at the edge. The database sits on a private network with no public interface at all.
Four promises, written so you can hold us to them.
We never sell or share your data
Not to advertisers, not to data brokers, not to anyone building a mailing list of schools, employers, or congregations. There is no version of this business where that is acceptable.
Every person can opt out of any channel
A teacher, a shift lead, or a volunteer who does not want automated calls can say so, per channel, and the fan-out respects it. Consent belongs to the person, not to the administrator who added them.
Your plan leaves with you
Export the full plan, the workflows, the roster, and every drill record at any time, in formats you can open without us. Ask us to delete your organization and we delete it.
We do not monitor your building
No cameras, no sensors, no location tracking, no listening. GWSafePlan only knows what you typed into it and what happened during an activation you started.
What happens when things are already going wrong.
A safety product has to assume the worst day, not the demo day.
Activation does not depend on your building
The fan-out runs from our servers over the public phone network. If your site loses power, internet, or both, your team’s phones still ring.
Paper is part of the design
Every plan exports to printable go-bag cards and wall posters. We expect a paper copy in the office, at the front desk, and in every go-bag, because a plan that only exists on a screen is not a plan.
No lock-in of any kind
PDF, Word, and structured exports on demand. If GWSafePlan disappeared tomorrow, your organization would still have its plan.
What GWSafePlan is not.
- It is not an emergency service. It does not dispatch anyone. Call 911 first, always.
- It is not a certification. FEMA does not certify software. Your plan follows CPG-101 structure and NIMS command, which is what your county emergency manager, your accreditor, and your insurer will look for — but no vendor can hand you compliance.
- It is not a substitute for your local relationships. The single most valuable thing you can do this month is invite your fire marshal to walk your building. The plan makes that visit more useful; it does not replace it.
Give it one afternoon.
Sit down with whoever knows the building best. By the end of the day you will have a real plan, real workflows, and a team that can be reached in seconds. Not a binder. A light left on.
No credit card to start. Export your plan at any time, even if you leave us.