Where your records are kept

A local's records are kept in one database in a data center in the United States, with uploaded files in private storage beside it. Every connection is encrypted, and the database and files are encrypted where they are stored.

Who can see a local's records

• Staff see what their permission preset allows, and a person limited to chosen employers sees nothing outside them. See Permissions.
• A member in the member portal sees only their own record.
• The people who run Candoa can open a local to help, and everything they do there is attributed to them by name in the local's history. Records are never shared with another local or an employer, and never used to train a model.

What is never stored

Social Security and Social Insurance numbers are never kept: a spreadsheet column holding them is refused by the import. Card numbers for online dues payments are entered on Stripe's page and never pass through Candoa.

Take a full copy of your records

An owner or admin can download everything at any time: under Settings, in the Local section, press Download everything. See Your local's profile. This works whether or not a payment has gone through.

Backups and the full picture

The database keeps a continuous history, so it can be restored to any moment within the last six hours. The full account, including which companies help run Candoa and what each one sees, what happens if Candoa closes, and how a local is told if something goes wrong, is on the public Security page, written to be forwarded to an executive board.