Built on Trust
NuvoWork was built to help businesses manage their workforce without sacrificing employee privacy.
Everything we collect has a purpose. Everything we protect matters.
Privacy First
- Employees are never tracked while off the clock.
- GPS is only collected when required for company-enabled verification.
- We do not sell user data.
- We do not use employee information for advertising.
- Workforce data belongs to the business and its employees.
Security
Passwords are stored as one-way hashes by our authentication provider. We never see or store plain-text passwords.
All traffic between your device and NuvoWork is encrypted in transit using TLS. We never send sensitive data over unsecured connections.
Employees see their own records. Company admins see only their own company's data. Platform admin access is tightly limited and used only for support and operations.
Important company actions are recorded permanently to an append-only audit log. Records include who changed what, the previous value, the new value, and when it happened.
Audit entries and payroll runs cannot be edited or deleted by admins or employees. This protects the integrity of your records.
Payroll runs can be locked after review. Once locked, the underlying time entries cannot be changed, so exported records match what was approved.
Multi-factor authentication (MFA) — Coming Soon. We are transparent about what is not yet available so you can make an informed decision.
GPS Transparency
GPS is not enabled by default. When a company chooses to use it, location is only collected for the specific verification moments the admin selects. Employees are notified in-app whenever the company changes its GPS policy.
When a company enables GPS verification, a single location snapshot may be recorded at clock-in.
A matching snapshot is recorded at clock-out so the record is complete and auditable.
Some companies may choose additional checkpoints during an active shift. This is optional and configured by the company admin.
No location is recorded before clock-in, after clock-out, on days off, or when the app is closed.
Audit Logging
Important company changes are permanently recorded. Because these logs are append-only, they create a reliable history that cannot be altered after the fact.
Your Data Stays Yours
NuvoWork exists to help your business operate — not to monetize your workforce data. We do not sell customer data, we do not build advertising profiles, and we only store the information necessary to provide the service.
Trusted Providers
We keep our subprocessor list short and purposeful. None of these providers receive data for advertising, profiling, or resale.
Lovable Cloud runs the application and stores company data. Row-level security policies enforce strict company isolation.
Supabase Auth handles password hashing, sign-in sessions, and secure token management.
Stripe processes Pro subscription payments. Card details are entered directly with Stripe and never touch our servers.
Resend delivers transactional emails such as invitations and password resets. No marketing lists are maintained.
When GPS is enabled, coordinates are converted to a readable address. Only the coordinates of a single clock event are sent, with no identifiers.
Your browser's push service delivers notifications you opt in to on your own device. Notification payloads are encrypted before leaving NuvoWork.
Works Like an App
NuvoWork installs directly to your phone's home screen in seconds — no app store download required. Employees clock in and out with one tap.
Workforce management built on trust.
Simple.
Private.
Secure.
Built for small businesses.