Security

This page answers the questions a treasurer or an executive board asks before moving a local's records into Candoa. It is written to be forwarded. Every sentence describes the service as it runs today; when something changes, this page changes with it and the date above moves.

Where the records are kept

A local's records live in one database, hosted by Neon in a data center in Northern Virginia, United States. The application runs on Vercel in the same region. Uploaded files, such as contracts, grievance attachments, and documents, are kept in private file storage on Vercel in the United States. Nothing is stored anywhere else, and no copy is made for any purpose but running the service and keeping it backed up.

Who can see them

Staff at the local. Every person signs in as themselves. What they see is decided by the permission preset the local gives them: Owner, Admin, Agent, Treasurer, Staff, Steward, or Read-only, and the local's owner can adjust what each preset may do. A person can also be limited to chosen employers and worksites, and then sees nothing outside them, on any screen or in any export.

Members, through the portal. A member who signs into the member portal sees their own record and nothing else, using a code sent to the email the local has on file.

Candoa. The people who run Candoa can open a local to help with support. When they do, everything they look at or change is attributed to them by name in the local's own history, the same way a staff member's actions are. They do not read a local's records except to help that local, and they never share them with another local, an employer, or anyone else.

No one else. Records are not sold, not used for advertising, and not used to train any model.

How they are protected

• Every connection to Candoa is encrypted. The database and file storage are encrypted at rest by the providers that run them.
• Passwords are never stored. Only a salted hash is kept, and a password that appears in a known breach is refused when it is set.
• Five failed sign-ins in ten minutes lock the account for a while, and every sign-in is recorded with its approximate location so a person can spot one that was not theirs.
• Any person can turn on two-step sign-in, a six-digit code by email, from their account page. Sign-in with Google or Microsoft is available for locals that use them.
• A sign-in that goes unused for a week ends on its own. From their account page a person sees every browser they are signed in on, with its location, and can sign out of all the others at once.
• Every change to a member's record is logged with the field, the old value, the new value, who made it, and when, and the log cannot be edited.

What is never stored

Candoa does not keep Social Security numbers or Social Insurance numbers. A spreadsheet column that holds them is refused by the import, whatever the column is called, and its contents are not read. Card numbers for online dues payments are entered on Stripe's own page and never pass through Candoa.

Backups

The database keeps a continuous history of every change, so it can be restored to any moment within the last six hours, not just to a nightly snapshot. A local can take its own full copy at any time with Download everything in Settings, and we recommend a treasurer does so monthly and keeps it with the local's other records.

Companies that help run Candoa

Each receives only what it needs for its part, under its own security commitments.

Company	What it does	What it sees
Vercel	Runs the application, stores uploaded files, counts page views without identifying anyone	Everything the application handles, in the course of running it
Neon	Hosts the database	The local's records
Stripe	Bills the local; takes online dues payments on the local's behalf	The local's billing details; a paying member's card, which Candoa never sees
Resend	Sends and receives email	The addresses and contents of email the local sends and receives through Candoa
Telnyx	Sends texts and places calls from the local's own number	The numbers and contents of those texts and calls
OpenAI, Google, and Anthropic, through Vercel's AI Gateway	Write Eli's answers, read contracts for search, transcribe recorded calls	The question asked and the records Eli needs to answer it; the contract text; the call audio. Not used to train their models
Google	Suggests addresses while one is typed	The partial address being typed
GitHub	Holds feedback sent from inside the app	The feedback text and screenshot, the page it was sent from, the local's name, and the sender's permission preset and language; nothing from a member's record

Taking your records out

A local's records are the local's. An owner or admin can download everything at any time from Settings: the roster and employer list as spreadsheets, plus every table the local has, including dues history, grievances, notes, documents, and the change log. This works whether or not a payment has gone through. Individual lists and reports download from their own screens.

If Candoa closes

Should Candoa ever stop operating, every local will be told at least 90 days ahead by email to its owner, the export will stay open for the whole of that time, and records will be deleted only after it. The same holds if the service is sold: records go nowhere a local has not been told about in advance.

If something goes wrong

If we learn that a local's records were seen by someone who should not have seen them, we tell that local's owner within 72 hours of knowing, with what was seen, what we did, and what the local may need to do. Errors in the running service are reported to us automatically, and a status question can always be sent to support@candoa.app.

Who is behind it

Candoa is built and run by Candoa LLC, 1730 Windsor Avenue, Lancaster, PA 17601. Questions about anything on this page: support@candoa.app. The Terms of Service and Privacy Policy say the same things in their own words.