Grievance records contain some of the most sensitive data in the labor movement — employee complaints, witness statements, disciplinary records, management correspondence, and legal strategy. GrieveRight protects this data with the same standards used by financial institutions and healthcare organizations.
At rest and in transit. No exceptions.
Every file uploaded to GrieveRight — grievance documents, witness statement attachments, complaint intake form attachments, contract uploads, and knowledge base PDFs — is encrypted before being written to storage using modern authenticated encryption.
Each union in the system has its own encryption key, derived from a master key using industry-standard key derivation. This means:
All connections to GrieveRight are encrypted with TLS 1.2+ via Cloudflare's CDN. HTTP connections are automatically upgraded to HTTPS. No unencrypted communication is ever accepted.
Encrypted files stored on enterprise-grade infrastructure.
GrieveRight's storage layer supports S3-compatible cloud backends, including Cloudflare R2 and AWS S3. All files are encrypted before they leave the application server, meaning the cloud provider itself cannot read your files. Even if someone gained access to the raw storage bucket, they would see only encrypted binary data.
Files are encrypted on the GrieveRight server before upload to cloud storage. The cloud provider only stores encrypted bytes.
Every file has a stored hash. On download, the hash is verified to ensure no tampering or corruption occurred.
Switch between local filesystem and S3-compatible cloud storage without any changes to your data or workflow.
Your data is your data. Period.
Privacy is not an afterthought in GrieveRight. It is the foundation of the architecture. The federated model is itself a privacy mechanism — data isolation between unions and between locals is enforced at the database query level, not just the application level.
The AI writing assistant is an optional feature that can be disabled entirely per deployment. When enabled, the AI processes grievance descriptions and contract text to provide suggestions. AI requests are rate-limited (20/hour per user), responses can be cached to minimize external API calls, and your union chooses the AI provider (OpenAI, Anthropic, or Google) based on your privacy requirements. The AI does not store your data, does not train on your data, and does not share your data with third parties. Every AI interaction is scoped to the individual grievance — it does not cross-reference between cases or users.
Multi-layer security from login to every action.
Passwords are hashed with industry-standard algorithms — we never store your actual password. Password reset tokens expire after 1 hour. Account activation links expire after 72 hours. Rate limiting on login attempts prevents brute-force attacks.
Three 2FA methods: authenticator apps (TOTP), SMS codes, and email verification. Recovery codes for backup access. Trusted devices remembered for 30 days. Union-wide enforcement available for administrators.
Every form submission is protected against cross-site request forgery. Per-session tokens are generated and verified on every POST request. No action can be triggered by an external site.
Every entity type (grievance, contract, user, document, etc.) has its own authorization policy class. Access checks are centralized and consistent. No ad-hoc permission checks scattered through the code.
Configurable per-action rate limits protect against abuse. Login, signup, file uploads, AI requests, email sending, and API endpoints are all rate-limited with per-user or per-IP scoping.
Every request is scoped to the user's union and local. This isolation is enforced at the data layer, not just the interface. Cross-tenant data access is architecturally impossible.
Every action is logged. Nothing is deleted.
GrieveRight maintains an immutable audit log of every significant action in the system. Audit entries are append-only — they can never be modified or deleted, even by administrators. This provides a complete, tamper-proof record of who did what, when, and what changed.
When a record is updated, the audit log captures exactly which fields changed, what the old values were, and what the new values are. This provides a complete history of every modification, not just "something changed."
Your data belongs to your union. Always.
We believe in radical data ownership. Your union's grievance records, documents, messages, and case history belong to you — not to us. GrieveRight is a tool you use, not a vault you're locked into. Here is exactly what that means:
Local administrators can request a complete export of all their data at any time. The export includes:
If your union decides to stop using GrieveRight, you take everything with you:
Multiple layers of protection between your data and the internet.
All traffic passes through Cloudflare's global network. DDoS protection, TLS termination, and edge caching for static assets.
Public forms (signup, contact, complaint intake) are protected by Cloudflare Turnstile CAPTCHA to prevent automated abuse.
All data access is protected against injection attacks at the platform level. User input is never treated as executable code.
All user-provided data is sanitized before display. Cross-site scripting attacks are prevented at the platform level, not left to chance.
Daily automated backups of all data and encrypted files. If something goes wrong, your grievance records can be restored quickly and completely.
Sessions are revalidated every 5 minutes. Session data is stored server-side. Session tokens are regenerated on login to prevent fixation attacks.
Join the unions that trust GrieveRight to keep their most sensitive records safe. Every plan includes the full security stack — no tiers, no add-ons.