Your workers' data is the most sensitive thing we hold. Here is exactly how we protect it.

H2A Link stores passport numbers, visa records, and confidential worker grievances — data that could cause real harm to real people if it leaked. We designed the platform around that fact, and we publish the details here rather than making you ask.

Encryption

Access control

Access is role-based and enforced on the server as an allowlist — every role can reach only the pages and data it needs, and everything else is denied by default:

• Ranchers see their own ranch's contracts, crews, and hours — never another ranch's.
• Workers see their own record only: visa status, hours, pay, and rides.
• Drivers get the checkpoint scanner and nothing else.
• Confidential grievances are visible to platform administrators only. The rancher a grievance may concern — and every other role — cannot see that it exists.

Sessions use hardware-random tokens stored only as hashes, in HttpOnly; Secure cookies. Passwords are hashed with scrypt. Sign-in is rate-limited per client to block credential-stuffing.

No third parties on your data's path

Retention, deletion & legal holds

We keep personal data only as long as the law and the work require, and we can prove it:

• DOL retention floor. H-2A employers must keep application, earnings, and compliance records for 3 years (20 CFR 655.167). Our purge engine enforces that floor mechanically — hours and transport records cannot be deleted until their contract is three full years past its end date, so using us never puts your DOL recordkeeping at risk.
• Purge with an audit trail. Expired personal data (passport numbers, identities, old inquiries) is removed on a published schedule; every purge is logged — who, when, and exactly what.
• Anonymize, don't orphan. Departed workers are stripped of identifying data while the records your audits depend on stay intact and consistent.
• Legal holds. A hold — for a DOL audit, a wage claim, litigation — freezes everything in its scope. While a hold is active, nothing it covers can be purged, no matter how old.

Who else touches the data

Our subprocessor list is unusually short, and we intend to keep it that way:

That's the list. Alert emails are sent from our own server; there is no third-party analytics, marketing, or data-enrichment service anywhere in the pipeline.

Operational practices

• An internal security audit of the full codebase has been completed and every code-level finding fixed and verified.
• Faults are isolated: a failure in one module of the platform degrades that module, not the whole service, and the service is monitored via an automated health check.
• A written breach-response plan, data-retention schedule, and bilingual privacy policy (English & Spanish) govern how data is handled.
• Workers are never charged recruiting fees, and the worker app is Spanish-first — protecting workers is a design goal, not a compliance checkbox.